Commit b0722cb1 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jens Axboe

cciss: freeing uninitialized data on error path

The "h->scatter_list" is allocated inside a for loop.  If any of those
allocations fail, then the rest of the list is uninitialized data.  When
we free it we should start from the top and free backwards so that we
don't call kfree() on uninitialized pointers.

Also if the allocation for "h->scatter_list" fails then we would get an
Oops here.  I should have noticed this when I send: 4ee69851 "cciss:
handle allocation failure."  but I didn't.  Sorry about that.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarJens Axboe <jaxboe@fusionio.com>
parent 2422084a
...@@ -4792,7 +4792,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev, ...@@ -4792,7 +4792,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
clean4: clean4:
kfree(h->cmd_pool_bits); kfree(h->cmd_pool_bits);
/* Free up sg elements */ /* Free up sg elements */
for (k = 0; k < h->nr_cmds; k++) for (k-- ; k >= 0; k--)
kfree(h->scatter_list[k]); kfree(h->scatter_list[k]);
kfree(h->scatter_list); kfree(h->scatter_list);
cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds); cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment