summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2018-03-19 13:34:01 +0300
committerMartin K. Petersen <martin.petersen@oracle.com>2018-03-21 18:34:19 -0400
commit10ff6be6de59e1c7d0bd5d899f896ce991f4fdc2 (patch)
tree6e204ea09c2e6bfc659aec402a4ee7c9a61eefca
parent24268fd1ad3213079f1af09359b4243fffa95869 (diff)
scsi: dpt_i2o: use after free in __adpt_reset()
In __adpt_reset() the problem is that adpt_hba_reset() frees "pHba" on error but we dereference it to print the name in the error message. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-rw-r--r--drivers/scsi/dpt_i2o.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index 67379e4d0bf9..35d45903ed2e 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -799,14 +799,17 @@ static int __adpt_reset(struct scsi_cmnd* cmd)
{
adpt_hba* pHba;
int rcode;
+ char name[32];
+
pHba = (adpt_hba*)cmd->device->host->hostdata[0];
- printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n",pHba->name,cmd->device->channel,pHba->channel[cmd->device->channel].tid );
+ strncpy(name, pHba->name, sizeof(name));
+ printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n", name, cmd->device->channel, pHba->channel[cmd->device->channel].tid);
rcode = adpt_hba_reset(pHba);
if(rcode == 0){
- printk(KERN_WARNING"%s: HBA reset complete\n",pHba->name);
+ printk(KERN_WARNING"%s: HBA reset complete\n", name);
return SUCCESS;
} else {
- printk(KERN_WARNING"%s: HBA reset failed (%x)\n",pHba->name, rcode);
+ printk(KERN_WARNING"%s: HBA reset failed (%x)\n", name, rcode);
return FAILED;
}
}