projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: f88c50c)
scsi: bnx2i: fix potential use after free
authorPan Bian <bianpan2016@163.com>
Wed, 6 Nov 2019 12:32:21 +0000 (20:32 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 23 Jan 2020 07:20:36 +0000 (08:20 +0100)
commit 29d28f2b8d3736ac61c28ef7e20fda63795b74d9 upstream.

The member hba->pcidev may be used after its reference is dropped. Move the
put function to where it is never used to avoid potential use after free
issues.

Fixes: a77171806515 ("[SCSI] bnx2i: Removed the reference to the netdev->base_addr")
Link: https://lore.kernel.org/r/1573043541-19126-1-git-send-email-bianpan2016@163.com
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/scsi/bnx2i/bnx2i_iscsi.c patch | blob | blame | history

diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
index 03c104b47f31c98670d9a80d64e0b986d707d9f0..b832bd0ce2021844f0ce27055b42638d3c094cb5 100644 (file)
--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
@@ -915,12 +915,12 @@ void bnx2i_free_hba(struct bnx2i_hba *hba)
        INIT_LIST_HEAD(&hba->ep_ofld_list);
        INIT_LIST_HEAD(&hba->ep_active_list);
        INIT_LIST_HEAD(&hba->ep_destroy_list);
-       pci_dev_put(hba->pcidev);
 
        if (hba->regview) {
                pci_iounmap(hba->pcidev, hba->regview);
                hba->regview = NULL;
        }
+       pci_dev_put(hba->pcidev);
        bnx2i_free_mp_bdt(hba);
        bnx2i_release_free_cid_que(hba);
        iscsi_host_free(shost);