scsi: dpt_i2o: double free if adpt_i2o_online_hba() fails
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 16 Dec 2016 09:35:39 +0000 (12:35 +0300)
committerMartin K. Petersen <martin.petersen@oracle.com>
Thu, 5 Jan 2017 05:21:12 +0000 (00:21 -0500)
There are two places where adpt_i2o_online_hba() is called.  Both
callers call adpt_i2o_delete_hba(pHba) if adpt_i2o_online_hba() fails
and since we also free it here that causes a double free bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/dpt_i2o.c

index 5f75e638ec95af5476f15780bf4fa6f7ea12a0b7..256dd6791fcc8bb0196e359ba6bd509c234080e3 100644 (file)
@@ -2768,16 +2768,12 @@ static int adpt_i2o_activate_hba(adpt_hba* pHba)
  
 static int adpt_i2o_online_hba(adpt_hba* pHba)
 {
-       if (adpt_i2o_systab_send(pHba) < 0) {
-               adpt_i2o_delete_hba(pHba);
+       if (adpt_i2o_systab_send(pHba) < 0)
                return -1;
-       }
        /* In READY state */
 
-       if (adpt_i2o_enable_hba(pHba) < 0) {
-               adpt_i2o_delete_hba(pHba);
+       if (adpt_i2o_enable_hba(pHba) < 0)
                return -1;
-       }
 
        /* In OPERATIONAL state  */
        return 0;