From 7709e9bdee96a904ebf18378c803a9288e10bb30 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 21 Mar 2018 11:09:42 +0300 Subject: scsi: dpt_i2o: Use after free in I2ORESETCMD ioctl Here is another use after free if we reset the card. The adpt_hba_reset() function frees "pHba" on error. Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen --- drivers/scsi/dpt_i2o.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'drivers') diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c index 6866975b25f3..5ceea8da7bb6 100644 --- a/drivers/scsi/dpt_i2o.c +++ b/drivers/scsi/dpt_i2o.c @@ -2051,13 +2051,16 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd, ulong ar } break; } - case I2ORESETCMD: - if(pHba->host) - spin_lock_irqsave(pHba->host->host_lock, flags); + case I2ORESETCMD: { + struct Scsi_Host *shost = pHba->host; + + if (shost) + spin_lock_irqsave(shost->host_lock, flags); adpt_hba_reset(pHba); - if(pHba->host) - spin_unlock_irqrestore(pHba->host->host_lock, flags); + if (shost) + spin_unlock_irqrestore(shost->host_lock, flags); break; + } case I2ORESCANCMD: adpt_rescan(pHba); break; -- cgit v1.2.3