| Message ID | 1573043541-19126-1-git-send-email-bianpan2016@163.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 29d28f2b8d3736ac61c28ef7e20fda63795b74d9 |
| Headers | show |
| Series | scsi: bnx2i: fix potential use after free | expand |
Pan, > The membe hba->pcidev may be used after its reference is dropped. Move > the put function to where it is never used to avoid potential use > after free issues. Applied to 5.5/scsi-queue, thanks!
diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c index c5fa5f3b00e9..0b28d44d3573 100644 --- a/drivers/scsi/bnx2i/bnx2i_iscsi.c +++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c @@ -915,12 +915,12 @@ void bnx2i_free_hba(struct bnx2i_hba *hba) INIT_LIST_HEAD(&hba->ep_ofld_list); INIT_LIST_HEAD(&hba->ep_active_list); INIT_LIST_HEAD(&hba->ep_destroy_list); - pci_dev_put(hba->pcidev); if (hba->regview) { pci_iounmap(hba->pcidev, hba->regview); hba->regview = NULL; } + pci_dev_put(hba->pcidev); bnx2i_free_mp_bdt(hba); bnx2i_release_free_cid_que(hba); iscsi_host_free(shost);
The membe hba->pcidev may be used after its reference is dropped. Move the put function to where it is never used to avoid potential use after free issues. Fixes: a77171806515 ("[SCSI] bnx2i: Removed the reference to the netdev->base_addr") Signed-off-by: Pan Bian <bianpan2016@163.com> --- drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)