Commit 10ff6be6 authored by Dan Carpenter's avatar Dan Carpenter Committed by Martin K. Petersen
Browse files

scsi: dpt_i2o: use after free in __adpt_reset() 



In __adpt_reset() the problem is that adpt_hba_reset() frees "pHba" on
error but we dereference it to print the name in the error message.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 24268fd1

drivers/scsi/dpt_i2o.c

+6 −3
Original line number Original line Diff line number Diff line
@@ -799,14 +799,17 @@ static int __adpt_reset(struct scsi_cmnd* cmd) 
{

{

	adpt_hba* pHba;

	adpt_hba* pHba;

	int rcode;

	int rcode;

	char name[32];



	pHba = (adpt_hba*)cmd->device->host->hostdata[0];

	pHba = (adpt_hba*)cmd->device->host->hostdata[0];

	printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n",pHba->name,cmd->device->channel,pHba->channel[cmd->device->channel].tid );

	strncpy(name, pHba->name, sizeof(name));

	printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n", name, cmd->device->channel, pHba->channel[cmd->device->channel].tid);

	rcode =  adpt_hba_reset(pHba);

	rcode =  adpt_hba_reset(pHba);

	if(rcode == 0){

	if(rcode == 0){

		printk(KERN_WARNING"%s: HBA reset complete\n",pHba->name);

		printk(KERN_WARNING"%s: HBA reset complete\n", name);

		return SUCCESS;

		return SUCCESS;

	} else {

	} else {

		printk(KERN_WARNING"%s: HBA reset failed (%x)\n",pHba->name, rcode);

		printk(KERN_WARNING"%s: HBA reset failed (%x)\n", name, rcode);

		return FAILED;

		return FAILED;

	}

	}

}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE