diff mbox

scsi: csiostor: fix use after free in csio_hw_use_fwconfig()

Message ID 1495033243-20262-1-git-send-email-varun@chelsio.com (mailing list archive)
State Accepted, archived
Headers show

Commit Message

Varun Prakash May 17, 2017, 3 p.m. UTC
mbp pointer is passed to csio_hw_validate_caps() so call
mempool_free() after calling csio_hw_validate_caps().

Signed-off-by: Varun Prakash <varun@chelsio.com>
---
 drivers/scsi/csiostor/csio_hw.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Johannes Thumshirn May 18, 2017, 7 a.m. UTC | #1
On 05/17/2017 05:00 PM, Varun Prakash wrote:
> mbp pointer is passed to csio_hw_validate_caps() so call
> mempool_free() after calling csio_hw_validate_caps().
> 
> Signed-off-by: Varun Prakash <varun@chelsio.com>
> ---

Fixes: 541c571fa2fd ("csiostor:Use firmware version from
cxgb4/t4fw_version.h")
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>

Thanks,
	Johannes
Martin K. Petersen May 19, 2017, 1:38 a.m. UTC | #2
Varun,

> mbp pointer is passed to csio_hw_validate_caps() so call
> mempool_free() after calling csio_hw_validate_caps().

Applied to 4.12/scsi-fixes. Thank you!
diff mbox

Patch

diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 5ca4099..c6e1814 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1780,7 +1780,6 @@  csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
 		goto bye;
 	}
 
-	mempool_free(mbp, hw->mb_mempool);
 	if (finicsum != cfcsum) {
 		csio_warn(hw,
 		      "Config File checksum mismatch: csum=%#x, computed=%#x\n",
@@ -1791,6 +1790,10 @@  csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
 	rv = csio_hw_validate_caps(hw, mbp);
 	if (rv != 0)
 		goto bye;
+
+	mempool_free(mbp, hw->mb_mempool);
+	mbp = NULL;
+
 	/*
 	 * Note that we're operating with parameters
 	 * not supplied by the driver, rather than from hard-wired