[PATCH] Fix SCSI scanning slab corruption
There is a double free in the scsi scan code if a LLDD's slave_alloc() call fails. There is a direct call to scsi_free_queue and then the following put_device calls the release function, which also frees the queue. Remove the redundant scsi_free_queue. Signed-off-by: Brian King <brking@us.ibm.com> Tested-by: Nathan Lynch <ntl@pobox.com> [ Also removed some strange whitespace artifacts in that area ] Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
49d7bc6428
commit
66e0522526
1 changed files with 0 additions and 3 deletions
|
@ -266,8 +266,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
|
||||||
/*
|
/*
|
||||||
* if LLDD reports slave not present, don't clutter
|
* if LLDD reports slave not present, don't clutter
|
||||||
* console with alloc failure messages
|
* console with alloc failure messages
|
||||||
|
|
||||||
|
|
||||||
*/
|
*/
|
||||||
if (ret == -ENXIO)
|
if (ret == -ENXIO)
|
||||||
display_failure_msg = 0;
|
display_failure_msg = 0;
|
||||||
|
@ -279,7 +277,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
|
||||||
|
|
||||||
out_device_destroy:
|
out_device_destroy:
|
||||||
transport_destroy_device(&sdev->sdev_gendev);
|
transport_destroy_device(&sdev->sdev_gendev);
|
||||||
scsi_free_queue(sdev->request_queue);
|
|
||||||
put_device(&sdev->sdev_gendev);
|
put_device(&sdev->sdev_gendev);
|
||||||
out:
|
out:
|
||||||
if (display_failure_msg)
|
if (display_failure_msg)
|
||||||
|
|
Loading…
Reference in a new issue