From 10ff6be6de59e1c7d0bd5d899f896ce991f4fdc2 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Mon, 19 Mar 2018 13:34:01 +0300 Subject: scsi: dpt_i2o: use after free in __adpt_reset() In __adpt_reset() the problem is that adpt_hba_reset() frees "pHba" on error but we dereference it to print the name in the error message. Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen --- drivers/scsi/dpt_i2o.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'drivers/scsi') diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c index 67379e4d0bf9..35d45903ed2e 100644 --- a/drivers/scsi/dpt_i2o.c +++ b/drivers/scsi/dpt_i2o.c @@ -799,14 +799,17 @@ static int __adpt_reset(struct scsi_cmnd* cmd) { adpt_hba* pHba; int rcode; + char name[32]; + pHba = (adpt_hba*)cmd->device->host->hostdata[0]; - printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n",pHba->name,cmd->device->channel,pHba->channel[cmd->device->channel].tid ); + strncpy(name, pHba->name, sizeof(name)); + printk(KERN_WARNING"%s: Hba Reset: scsi id %d: tid: %d\n", name, cmd->device->channel, pHba->channel[cmd->device->channel].tid); rcode = adpt_hba_reset(pHba); if(rcode == 0){ - printk(KERN_WARNING"%s: HBA reset complete\n",pHba->name); + printk(KERN_WARNING"%s: HBA reset complete\n", name); return SUCCESS; } else { - printk(KERN_WARNING"%s: HBA reset failed (%x)\n",pHba->name, rcode); + printk(KERN_WARNING"%s: HBA reset failed (%x)\n", name, rcode); return FAILED; } } -- cgit v1.2.3-55-g7522