Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0dd2c52e authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "Prevent potential double frees in sg driver"

parents 86951c6d 0396304e

drivers/scsi/sg.c

+13 −10
Original line number Diff line number Diff line
@@ -891,8 +891,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) 
			return -ENXIO;

		if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))

			return -EFAULT;

		mutex_lock(&sfp->parentdp->open_rel_lock);

		result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,

				 1, read_only, 1, &srp);

		mutex_unlock(&sfp->parentdp->open_rel_lock);

		if (result < 0)

			return result;

		result = wait_event_interruptible(sfp->read_wait,
@@ -1004,9 +1006,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) 
				mutex_unlock(&sfp->f_mutex);

				return -EBUSY;

			}



			mutex_lock(&sfp->parentdp->open_rel_lock);

			sg_remove_scat(sfp, &sfp->reserve);

			sg_build_reserve(sfp, val);

			mutex_unlock(&sfp->parentdp->open_rel_lock);

		}

		mutex_unlock(&sfp->f_mutex);

		return 0;