linux-kernel - [PATCH] lpfc: fix double free on mp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1438359324-8834-1-git-send-email-colin.king@canonical.com>
Date:	Fri, 31 Jul 2015 17:15:24 +0100
From:	Colin King <colin.king@...onical.com>
To:	James Smart <james.smart@...gotech.com>,
	Dick Kennedy <dick.kennedy@...gotech.com>,
	"James E.J. Bottomley" <JBottomley@...n.com>,
	linux-scsi@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org
Subject: [PATCH] lpfc: fix double free on mp

From: Colin Ian King <colin.king@...onical.com>

The error path when the call to lpfc_sli_issue_mbox returns
MBX_NOT_FINISHED results in the code freeing mp and calling
lpfc_mbuf_free twice.   Fix this by jumping to the correct
part of the error clean up path.

Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/scsi/lpfc/lpfc_mbox.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
index eb62772..750f34d 100644
--- a/drivers/scsi/lpfc/lpfc_mbox.c
+++ b/drivers/scsi/lpfc/lpfc_mbox.c
@@ -2299,13 +2299,14 @@ lpfc_mbx_cmpl_rdp_page_a2(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
 	mbox->mbox_cmpl = lpfc_mbx_cmpl_rdp_link_stat;
 	mbox->context2 = (struct lpfc_rdp_context *) rdp_context;
 	if (lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT) == MBX_NOT_FINISHED)
-		goto error;
+		goto cmd_free;
 
 	return;
 
 error:
 	lpfc_mbuf_free(phba, mp->virt, mp->phys);
 	kfree(mp);
+cmd_free:
 	lpfc_sli4_mbox_cmd_free(phba, mbox);
 	rdp_context->cmpl(phba, rdp_context, FAILURE);
 }
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/