| From 15309b2d272e6133678fe840eb7e734423ad3c96 Mon Sep 17 00:00:00 2001 |
| From: Pan Bian <bianpan2016@163.com> |
| Date: Wed, 6 Nov 2019 20:32:21 +0800 |
| Subject: [PATCH] scsi: bnx2i: fix potential use after free |
| |
| commit 29d28f2b8d3736ac61c28ef7e20fda63795b74d9 upstream. |
| |
| The member hba->pcidev may be used after its reference is dropped. Move the |
| put function to where it is never used to avoid potential use after free |
| issues. |
| |
| Fixes: a77171806515 ("[SCSI] bnx2i: Removed the reference to the netdev->base_addr") |
| Link: https://lore.kernel.org/r/1573043541-19126-1-git-send-email-bianpan2016@163.com |
| Signed-off-by: Pan Bian <bianpan2016@163.com> |
| Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c |
| index c5fa5f3b00e9..0b28d44d3573 100644 |
| --- a/drivers/scsi/bnx2i/bnx2i_iscsi.c |
| +++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c |
| @@ -915,12 +915,12 @@ void bnx2i_free_hba(struct bnx2i_hba *hba) |
| INIT_LIST_HEAD(&hba->ep_ofld_list); |
| INIT_LIST_HEAD(&hba->ep_active_list); |
| INIT_LIST_HEAD(&hba->ep_destroy_list); |
| - pci_dev_put(hba->pcidev); |
| |
| if (hba->regview) { |
| pci_iounmap(hba->pcidev, hba->regview); |
| hba->regview = NULL; |
| } |
| + pci_dev_put(hba->pcidev); |
| bnx2i_free_mp_bdt(hba); |
| bnx2i_release_free_cid_que(hba); |
| iscsi_host_free(shost); |
| -- |
| 2.7.4 |
| |
