Re: [PATCH] mpt2sas/mpt3sas: prevent double free on error path

2013-05-22 Thread Jörn Engel
On Wed, 22 May 2013 13:48:17 -0700, Andrew Morton wrote: > > It's regrettable that this bugfix is joined at the hip with a new > kernel feature. Not merged at the hip, I merely ended up reusing an old temp directory for the new patch series (hips for brains?). Ignore this patch. Jörn -- No art

Re: [PATCH] mpt2sas/mpt3sas: prevent double free on error path

2013-05-22 Thread Andrew Morton
On Thu, 9 May 2013 16:42:58 -0400 Joern Engel wrote: > I noticed this one when list_del was called with poisoned list > pointers, but the real problem is a double-free (and a use-after-free > just before that). > > Both _scsih_probe_boot_devices() and _scsih_sas_device_add() put the > sas_devic

Re: [PATCH] mpt2sas/mpt3sas: prevent double free on error path

2013-05-09 Thread Jörn Engel
On Thu, 9 May 2013 16:42:58 -0400, Joern Engel wrote: > Subject: [PATCH] mpt2sas/mpt3sas: prevent double free on error path The two mtp[23]sas patches shouldn't have been in here. Sorry about the noise! Jörn -- Das Aufregende am Schreiben ist es, eine Ordnung zu schaffen, wo vorh

[PATCH] mpt2sas/mpt3sas: prevent double free on error path

2013-05-09 Thread Joern Engel
I noticed this one when list_del was called with poisoned list pointers, but the real problem is a double-free (and a use-after-free just before that). Both _scsih_probe_boot_devices() and _scsih_sas_device_add() put the sas_device onto a list, thereby giving up control. Next they call mpt2sas_tr