[PATCH] mpt2sas: prevent double free on error path

2013-05-09 Thread Joern Engel
I noticed this one when list_del was called with poisoned list pointers, but the real problem is a double-free (and a use-after-free just before that). Both _scsih_probe_boot_devices() and _scsih_sas_device_add() put the sas_device onto a list, thereby giving up control. Next they call mpt2sas_tr

Re: [PATCH] mpt2sas: prevent double free on error path

2013-01-25 Thread Jörn Engel
On Thu, 24 January 2013 08:51:20 +0100, Bjørn Mork wrote: > > How about the copy of this code in drivers/scsi/mpt3sas/mpt3sas_scsih.c? > Is that safe, or does it need fixing as well? Well spotted, that appears to suffer from the same ailment. Will cook up a second patch for that. Are there any

Re: [PATCH] mpt2sas: prevent double free on error path

2013-01-23 Thread Bjørn Mork
Jörn Engel writes: > diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c > b/drivers/scsi/mpt2sas/mpt2sas_scsih.c > index c6bdc92..43b3a98 100644 > --- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c > +++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c > @@ -570,6 +570,18 @@ _scsih_sas_device_find_by_handle(struct

[PATCH] mpt2sas: prevent double free on error path

2013-01-23 Thread Jörn Engel
I noticed this one when list_del was called with poisoned list pointers, but the real problem is a double-free (and a use-after-free just before that). Both _scsih_probe_boot_devices() and _scsih_sas_device_add() put the sas_device onto a list, thereby giving up control. Next they call mpt2sas_tr