evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

scsi: bnx2i: fix potential use after free

Browse source 
commit 29d28f2b8d3736ac61c28ef7e20fda63795b74d9 upstream.

The member hba->pcidev may be used after its reference is dropped. Move the
put function to where it is never used to avoid potential use after free
issues.

Fixes: a771718065 ("[SCSI] bnx2i: Removed the reference to the netdev->base_addr")
Link: https://lore.kernel.org/r/1573043541-19126-1-git-send-email-bianpan2016@163.com
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pan Bian 2019-11-06 20:32:21 +08:00 • committed by Greg Kroah-Hartman
parent d85074fe9e
commit e4285e8d98
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/scsi/bnx2i/bnx2i_iscsi.c
View file

@ -915,12 +915,12 @@ void bnx2i_free_hba(struct bnx2i_hba *hba)
INIT_LIST_HEAD(&hba->ep_ofld_list); INIT_LIST_HEAD(&hba->ep_ofld_list);
INIT_LIST_HEAD(&hba->ep_active_list); INIT_LIST_HEAD(&hba->ep_active_list);
INIT_LIST_HEAD(&hba->ep_destroy_list); INIT_LIST_HEAD(&hba->ep_destroy_list);
pci_dev_put(hba->pcidev);
if (hba->regview) { if (hba->regview) {
pci_iounmap(hba->pcidev, hba->regview); pci_iounmap(hba->pcidev, hba->regview);
hba->regview = NULL; hba->regview = NULL;
} }
pci_dev_put(hba->pcidev);
bnx2i_free_mp_bdt(hba); bnx2i_free_mp_bdt(hba);
bnx2i_release_free_cid_que(hba); bnx2i_release_free_cid_que(hba);
iscsi_host_free(shost); iscsi_host_free(shost);