diff mbox

[2/2] scsi: dpt_i2o: use after free in __adpt_reset()

Message ID 20180319103401.GB8543@mwanda (mailing list archive)
State Accepted
Headers show

Commit Message

Dan Carpenter March 19, 2018, 10:34 a.m. UTC 
In __adpt_reset() the problem is that adpt_hba_reset() frees "pHba" on
error but we dereference it to print the name in the error message.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Martin K. Petersen March 20, 2018, 3:09 a.m. UTC | #1 
Dan,

> In __adpt_reset() the problem is that adpt_hba_reset() frees "pHba" on
> error but we dereference it to print the name in the error message.

Applied to 4.17/scsi-queue.
diff mbox

Patch

diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index 3c667b23a801..ac2f40d9963b 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -797,14 +797,17 @@  static int __adpt_reset(struct scsi_cmnd* cmd)
 {
 	adpt_hba* pHba;
 	int rcode;
+	char name[32];
+
 	pHba = (adpt_hba*)cmd->device->host->hostdata[0];
-	printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n",pHba->name,cmd->device->channel,pHba->channel[cmd->device->channel].tid );
+	strncpy(name, pHba->name, sizeof(name));
+	printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n", name, cmd->device->channel, pHba->channel[cmd->device->channel].tid);
 	rcode =  adpt_hba_reset(pHba);
 	if(rcode == 0){
-		printk(KERN_WARNING"%s: HBA reset complete\n",pHba->name);
+		printk(KERN_WARNING"%s: HBA reset complete\n", name);
 		return SUCCESS;
 	} else {
-		printk(KERN_WARNING"%s: HBA reset failed (%x)\n",pHba->name, rcode);
+		printk(KERN_WARNING"%s: HBA reset failed (%x)\n", name, rcode);
 		return FAILED;
 	}
 }