Skip to content

Commit 1bd3a76

Browse files
PeterZhu789martinkpetersen
authored andcommitted
scsi: snic: Fix double free in snic_tgt_create()
Commit 41320b1 ("scsi: snic: Fix possible memory leak if device_add() fails") fixed the memory leak caused by dev_set_name() when device_add() failed. However, it did not consider that 'tgt' has already been released when put_device(&tgt->dev) is called. Remove kfree(tgt) in the error path to avoid double free of 'tgt' and move put_device(&tgt->dev) after the removed kfree(tgt) to avoid a use-after-free. Fixes: 41320b1 ("scsi: snic: Fix possible memory leak if device_add() fails") Signed-off-by: Zhu Wang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Martin K. Petersen <[email protected]>
1 parent 60c5fd2 commit 1bd3a76

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

drivers/scsi/snic/snic_disc.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -303,12 +303,11 @@ snic_tgt_create(struct snic *snic, struct snic_tgt_id *tgtid)
303303
"Snic Tgt: device_add, with err = %d\n",
304304
ret);
305305

306-
put_device(&tgt->dev);
307306
put_device(&snic->shost->shost_gendev);
308307
spin_lock_irqsave(snic->shost->host_lock, flags);
309308
list_del(&tgt->list);
310309
spin_unlock_irqrestore(snic->shost->host_lock, flags);
311-
kfree(tgt);
310+
put_device(&tgt->dev);
312311
tgt = NULL;
313312

314313
return tgt;

0 commit comments

Comments
 (0)