Skip to contentSkip to conversation

ses: double free

PATCH New Dan Carpenter 1 participant 1 message Jan 19, 2010 SCSI

lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ses: double free

There are some code paths that go to err_free after already calling kfree(hdr_buf). I moved the kfree() lower to avoid the double free.

Signed-off-by Dan Carpenter <[email protected]>
Cc [email protected]
drivers/scsi/ses.c +1 -1
@@ -591,7 +591,6 @@ static int ses_intf_add(struct device *c
 		ses_dev->page10_len = len;
 		buf = NULL;
 	}
-	kfree(hdr_buf);
 
 	scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL);
 	if (!scomp)

@@ -618,6 +617,7 @@ static int ses_intf_add(struct device *c
 		ses_match_to_enclosure(edev, tmp_sdev);
 	}
 
+	kfree(hdr_buf);
 	return 0;
 
  recv_failed: