From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751481AbcFWPH7 (ORCPT ); Thu, 23 Jun 2016 11:07:59 -0400 Received: from mx4-phx2.redhat.com ([209.132.183.25]:50837 "EHLO mx4-phx2.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751308AbcFWPH6 (ORCPT ); Thu, 23 Jun 2016 11:07:58 -0400 Date: Thu, 23 Jun 2016 11:07:46 -0400 (EDT) From: Laurence Oberman To: Johannes Thumshirn Cc: "Martin K . Petersen" , James Bottomley , Linux SCSI Mailinglist , Linux Kernel Mailinglist , Narsimhulu Musini , Sesidhar Baddela Message-ID: <1818494207.887633.1466694466763.JavaMail.zimbra@redhat.com> In-Reply-To: <20160623123720.24244-1-jthumshirn@suse.de> References: <20160623123720.24244-1-jthumshirn@suse.de> Subject: Re: [PATCH] snic: Fix use-after-free in case of a dma mapping error MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [10.18.49.29] X-Mailer: Zimbra 8.0.6_GA_5922 (ZimbraWebClient - FF38 (Linux)/8.0.6_GA_5922) Thread-Topic: snic: Fix use-after-free in case of a dma mapping error Thread-Index: /qyOpa7dQBybtnwn+Xsr9K1MSttgRA== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ----- Original Message ----- > From: "Johannes Thumshirn" > To: "Martin K . Petersen" , "James Bottomley" > Cc: "Linux SCSI Mailinglist" , "Linux Kernel Mailinglist" , > "Narsimhulu Musini" , "Sesidhar Baddela" , "Johannes Thumshirn" > > Sent: Thursday, June 23, 2016 8:37:20 AM > Subject: [PATCH] snic: Fix use-after-free in case of a dma mapping error > > If there is a dma mapping error snic kfree()s buf right before printing it. > Change the order to not accidently trip on memory that's not owned by us > anymore. > > Signed-off-by: Johannes Thumshirn > --- > drivers/scsi/snic/snic_disc.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/scsi/snic/snic_disc.c b/drivers/scsi/snic/snic_disc.c > index b0fefd6..b106596 100644 > --- a/drivers/scsi/snic/snic_disc.c > +++ b/drivers/scsi/snic/snic_disc.c > @@ -113,11 +113,11 @@ snic_queue_report_tgt_req(struct snic *snic) > > pa = pci_map_single(snic->pdev, buf, buf_len, PCI_DMA_FROMDEVICE); > if (pci_dma_mapping_error(snic->pdev, pa)) { > - kfree(buf); > - snic_req_free(snic, rqi); > SNIC_HOST_ERR(snic->shost, > "Rpt-tgt rspbuf %p: PCI DMA Mapping Failed\n", > buf); > + kfree(buf); > + snic_req_free(snic, rqi); > ret = -EINVAL; > > goto error; > -- > 2.8.4 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-scsi" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Looks fine to me Reviewed-by Laurence Oberman