fix use after kfree() bugs in dpt_i2o.c
PATCH 1/1 fix use after kfree() bugs in dpt_i2o.c
I re-orderred things a bit.
All four bugs were found by smatch (http://repo.or.cz/w/smatch.git), but I had to wade through a gazillion false positives as well so smatch still sucks. Compile tested.
regards,
dan carpenter
Signed-off-by Dan Carpenter <[email protected]>
drivers/scsi/dpt_i2o.c +8 -5
@@ -189,6 +189,7 @@ {struct pci_dev *pDev =NULL ;adpt_hba * pHba; +adpt_hba * next;PINFO ("Detecting Adaptec I2O RAID controllers...\n" );
@@ -206,7 +207,8 @@ }/* In INIT state, Activate IOPs */ -for (pHba = hba_chain; pHba; pHba = pHba->next) { +for (pHba = hba_chain; pHba; pHba = next) { + next = pHba->next;// Activate does get status , init outbound, and get hrt if (adpt_i2o_activate_hba (pHba) <0 ) {adpt_i2o_delete_hba (pHba);
@@ -243,7 +245,8 @@PDEBUG ("HBA's in OPERATIONAL state\n" );printk ("dpti: If you have a lot of devices this could take a few minutes.\n" ); -for (pHba = hba_chain; pHba; pHba = pHba->next) { +for (pHba = hba_chain; pHba; pHba = next) { + next = pHba->next;printk (KERN_INFO "%s: Reading the hardware resource table.\n" , pHba->name);if (adpt_i2o_lct_get (pHba) <0 ){adpt_i2o_delete_hba (pHba);
@@ -263,7 +266,8 @@ adpt_sysfs_class =NULL ; } -for (pHba = hba_chain; pHba; pHba = pHba->next) { +for (pHba = hba_chain; pHba; pHba = next) { + next = pHba->next;if (adpt_scsi_host_alloc (pHba, sht) <0 ){adpt_i2o_delete_hba (pHba);continue ;
@@ -1229,11 +1233,10 @@ } }pci_dev_put (pHba->pDev); -kfree (pHba); -if (adpt_sysfs_class)device_destroy (adpt_sysfs_class,MKDEV (DPTI_I2O_MAJOR , pHba->unit)); +kfree (pHba);if (hba_count <=0 ){unregister_chrdev (DPTI_I2O_MAJOR ,DPT_DRIVER );