Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7709e9bd authored by Dan Carpenter's avatar Dan Carpenter Committed by Martin K. Petersen
Browse files

scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl 



Here is another use after free if we reset the card.  The adpt_hba_reset()
function frees "pHba" on error.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent f4abab3f

drivers/scsi/dpt_i2o.c

+8 −5
Original line number Diff line number Diff line
@@ -2051,13 +2051,16 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd, ulong ar 
		}

		break;

		}

	case I2ORESETCMD:

		if(pHba->host)

			spin_lock_irqsave(pHba->host->host_lock, flags);

	case I2ORESETCMD: {

		struct Scsi_Host *shost = pHba->host;



		if (shost)

			spin_lock_irqsave(shost->host_lock, flags);

		adpt_hba_reset(pHba);

		if(pHba->host)

			spin_unlock_irqrestore(pHba->host->host_lock, flags);

		if (shost)

			spin_unlock_irqrestore(shost->host_lock, flags);

		break;

	}

	case I2ORESCANCMD:

		adpt_rescan(pHba);

		break;