Merge "Prevent potential double frees in sg driver" (f86c9c29) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/scsi/sg.c

+20 −13

Original line number	Diff line number	Diff line
		@@ -881,8 +881,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
		return -ENXIO;
		if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))
		return -EFAULT;
		mutex_lock(&sfp->parentdp->open_rel_lock);
		result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
		1, read_only, 1, &srp);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		if (result < 0)
		return result;
		result = wait_event_interruptible(sfp->read_wait,
		@@ -924,6 +926,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
		val = (int) sfp->reserve.bufflen;
		sg_remove_scat(sfp, &sfp->reserve);
		sg_build_reserve(sfp, val);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		}
		} else {
		if (atomic_read(&sdp->detaching))
		@@ -1005,6 +1008,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)

		sg_remove_scat(sfp, &sfp->reserve);
		sg_build_reserve(sfp, val);
		mutex_unlock(&sfp->parentdp->open_rel_lock);
		}
		mutex_unlock(&sfp->f_mutex);
		return 0;
		@@ -2705,6 +2709,9 @@ static void sg_proc_debug_helper(struct seq_file s, Sg_device sdp)
		seq_puts(s, srp->done ?
		((1 == srp->done) ? "rcv:" : "fin:")
		: "act:");
		seq_printf(s, srp->done ?
		((1 == srp->done) ? "rcv:" : "fin:")
		: "act:");
		seq_printf(s, " id=%d blen=%d",
		srp->header.pack_id, blen);
		if (srp->done)