Merge "Prevent potential double frees in sg driver" (bec722f5) · Commits · e / devices / android_kernel_sony_msm8998

drivers/scsi/sg.c

+18 −9

Original line number	Diff line number	Diff line
		@@ -863,8 +863,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
		return -ENXIO;
		if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))
		return -EFAULT;
		mutex_lock(&sfp->parentdp->open_rel_lock);
		result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
		1, read_only, 1, &srp);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		if (result < 0)
		return result;
		result = wait_event_interruptible(sfp->read_wait,
		@@ -904,8 +906,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
		sfp->low_dma = 1;
		if ((0 == sfp->low_dma) && (0 == sg_res_in_use(sfp))) {
		val = (int) sfp->reserve.bufflen;
		mutex_lock(&sfp->parentdp->open_rel_lock);
		sg_remove_scat(sfp, &sfp->reserve);
		sg_build_reserve(sfp, val);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		}
		} else {
		if (atomic_read(&sdp->detaching))
		@@ -980,8 +984,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
		if (val != sfp->reserve.bufflen) {
		if (sg_res_in_use(sfp) \|\| sfp->mmap_called)
		return -EBUSY;
		mutex_lock(&sfp->parentdp->open_rel_lock);
		sg_remove_scat(sfp, &sfp->reserve);
		sg_build_reserve(sfp, val);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		}
		return 0;
		case SG_GET_RESERVED_SIZE:
		@@ -2643,6 +2649,9 @@ static void sg_proc_debug_helper(struct seq_file s, Sg_device sdp)
		seq_puts(s, srp->done ?
		((1 == srp->done) ? "rcv:" : "fin:")
		: "act:");
		seq_printf(s, srp->done ?
		((1 == srp->done) ? "rcv:" : "fin:")
		: "act:");
		seq_printf(s, " id=%d blen=%d",
		srp->header.pack_id, blen);
		if (srp->done)