mirror of
https://github.com/torvalds/linux
synced 2024-11-05 18:23:50 +00:00
612872cabf
If the bf_get() call in lpfc_mbx_cmpl_rdp_page_a2() does succeeds, execution continues normally and mp gets kfree()d. If the subsequent call to lpfc_sli_issue_mbox() fails execution jumps to the error label where lpfc_mbuf_free() is called with mp->virt and mp->phys as function arguments. This is the use after free. Following the use after free mp gets kfree()d again which is a double free. Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de> Acked-by: James Smart <james.smart@avagotech.com> Signed-off-by: James Bottomley <JBottomley@Odin.com> |
||
|---|---|---|
| .. | ||
| lpfc.h | ||
| lpfc_attr.c | ||
| lpfc_bsg.c | ||
| lpfc_bsg.h | ||
| lpfc_compat.h | ||
| lpfc_crtn.h | ||
| lpfc_ct.c | ||
| lpfc_debugfs.c | ||
| lpfc_debugfs.h | ||
| lpfc_disc.h | ||
| lpfc_els.c | ||
| lpfc_hbadisc.c | ||
| lpfc_hw.h | ||
| lpfc_hw4.h | ||
| lpfc_init.c | ||
| lpfc_logmsg.h | ||
| lpfc_mbox.c | ||
| lpfc_mem.c | ||
| lpfc_nl.h | ||
| lpfc_nportdisc.c | ||
| lpfc_scsi.c | ||
| lpfc_scsi.h | ||
| lpfc_sli.c | ||
| lpfc_sli.h | ||
| lpfc_sli4.h | ||
| lpfc_version.h | ||
| lpfc_vport.c | ||
| lpfc_vport.h | ||
| Makefile | ||