From patchwork Tue Aug 8 11:40:30 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pan Bian X-Patchwork-Id: 9887649 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E588860384 for ; Tue, 8 Aug 2017 11:42:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D814D287DC for ; Tue, 8 Aug 2017 11:42:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CD241287E0; Tue, 8 Aug 2017 11:42:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6DA7C287DC for ; Tue, 8 Aug 2017 11:42:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752254AbdHHLmT (ORCPT ); Tue, 8 Aug 2017 07:42:19 -0400 Received: from m12-17.163.com ([220.181.12.17]:57087 "EHLO m12-17.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752182AbdHHLmS (ORCPT ); Tue, 8 Aug 2017 07:42:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id; bh=JAbax+vJcBasDCqLb3 EhISM7ksHtKL9J1j2FCxvO184=; b=ZQhmcDc3jbTK4KsoAi/KXu09Q9CSl2i9VB Ty1sf3VKJIFkLF2cYQbOp7qcpolvNEr8dnFVFPtlFVRGvQOJ3aaaQFkl5jZzHlLS 5RpR+4Xj46L/LK6Qcz7mRb5X6pRefQQ3lPVPZ9YdIx0K/vCBByLSVou1uSZrYjgG +W+aCiC8E= Received: from localhost.localdomain (unknown [106.120.213.62]) by smtp13 (Coremail) with SMTP id EcCowAAX1ZE5o4lZMbxuDQ--.13618S3; Tue, 08 Aug 2017 19:40:43 +0800 (CST) From: Pan Bian To: Jack Wang , lindar_liu@usish.com, "James E.J. Bottomley" , "Martin K. Petersen" Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Pan Bian Subject: scsi: pm8001: fix double free in pm8001_pci_probe Date: Tue, 8 Aug 2017 19:40:30 +0800 Message-Id: <1502192430-12440-1-git-send-email-bianpan2016@163.com> X-Mailer: git-send-email 1.9.1 X-CM-TRANSID: EcCowAAX1ZE5o4lZMbxuDQ--.13618S3 X-Coremail-Antispam: 1Uf129KBjvJXoW7WF48CFWkGr43CF4UGw17KFg_yoW8Ar1Dpr WrCrWjkr48Jr1j9rsxAF1UJwn0gFZxGry3urWkCw1a9F45W3yvqr1xCFyjgFy3JFWkCan8 JF4kKFnrGFy8JrUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07j-2-OUUUUU= X-Originating-IP: [106.120.213.62] X-CM-SenderInfo: held01tdqsiiqw6rljoofrz/1tbiNhsuclWBXF0SywAAs9 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In function pm8001_pci_probe(), on errors that the control flow jumps to label err_out_ha_free, function pm8001_free() is called. In pm8001_free(), scsi_host_put() is called to release shost, which keeps the return value of scsi_host_alloc(). After pm8001_free() returns, kfree() is called to free shost again, resulting in a double free bug. This patch removes scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put() to release Scsi_Host in need. Signed-off-by: Pan Bian Reviewed-by: Jack Wang --- drivers/scsi/pm8001/pm8001_init.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c index 034b2f7..2908881 100644 --- a/drivers/scsi/pm8001/pm8001_init.c +++ b/drivers/scsi/pm8001/pm8001_init.c @@ -160,8 +160,6 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha) } } PM8001_CHIP_DISP->chip_iounmap(pm8001_ha); - if (pm8001_ha->shost) - scsi_host_put(pm8001_ha->shost); flush_workqueue(pm8001_wq); kfree(pm8001_ha->tags); kfree(pm8001_ha); @@ -1073,7 +1071,7 @@ static int pm8001_pci_probe(struct pci_dev *pdev, err_out_free: kfree(SHOST_TO_SAS_HA(shost)); err_out_free_host: - kfree(shost); + scsi_host_put(shost); err_out_regions: pci_release_regions(pdev); err_out_disable: @@ -1112,6 +1110,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev) for (j = 0; j < PM8001_MAX_MSIX_VEC; j++) tasklet_kill(&pm8001_ha->tasklet[j]); #endif + scsi_host_put(pm8001_ha->shost); pm8001_free(pm8001_ha); kfree(sha->sas_phy); kfree(sha->sas_port);