diff options
| author | Peter Oberparleiter <peter.oberparleiter@de.ibm.com> | 2009-12-07 12:51:15 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-01-28 15:02:20 -0800 |
| commit | f5b1bc5470c2871fda157d55bc27746422b7112c (patch) | |
| tree | 2b023057a11f902c269993d1bd69fa3ca18b3799 | |
| parent | da0297498ee0e4a73ac74beae564dc72abbe6f48 (diff) | |
| download | linux-ak78xx-f5b1bc5470c2871fda157d55bc27746422b7112c.tar.gz | |
cio: fix double free in case of probe failure
commit 48e4c385c5f54626651cca027afe242439281899 upstream.
io_subchannel_probe() frees memory for sch->private which is later
freed again when io_subchannel_remove() is called. Fix this problem
by removing the cleanup in io_subchannel_probe().
Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/s390/cio/device.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c index 2490b741e16..55f997308e4 100644 --- a/drivers/s390/cio/device.c +++ b/drivers/s390/cio/device.c @@ -1292,7 +1292,7 @@ static int io_subchannel_probe(struct subchannel *sch) sch->private = kzalloc(sizeof(struct io_subchannel_private), GFP_KERNEL | GFP_DMA); if (!sch->private) - goto out_err; + goto out_schedule; /* * First check if a fitting device may be found amongst the * disconnected devices or in the orphanage. @@ -1317,7 +1317,7 @@ static int io_subchannel_probe(struct subchannel *sch) } cdev = io_subchannel_create_ccwdev(sch); if (IS_ERR(cdev)) - goto out_err; + goto out_schedule; rc = io_subchannel_recog(cdev, sch); if (rc) { spin_lock_irqsave(sch->lock, flags); @@ -1325,9 +1325,7 @@ static int io_subchannel_probe(struct subchannel *sch) spin_unlock_irqrestore(sch->lock, flags); } return 0; -out_err: - kfree(sch->private); - sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group); + out_schedule: io_subchannel_schedule_removal(sch); return 0; @@ -1341,13 +1339,14 @@ io_subchannel_remove (struct subchannel *sch) cdev = sch_get_cdev(sch); if (!cdev) - return 0; + goto out_free; /* Set ccw device to not operational and drop reference. */ spin_lock_irqsave(cdev->ccwlock, flags); sch_set_cdev(sch, NULL); cdev->private->state = DEV_STATE_NOT_OPER; spin_unlock_irqrestore(cdev->ccwlock, flags); ccw_device_unregister(cdev); +out_free: kfree(sch->private); sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group); return 0; |