scsi: snic: Fix double free in snic_tgt_create()
stable inclusion from stable-v5.10.193 commit 5d02f4320a9502201bf9c174747a0dc4deb4d205 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9399M Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5d02f4320a9502201bf9c174747a0dc4deb4d205 -------------------------------- commit 1bd3a768 upstream. Commit 41320b18 ("scsi: snic: Fix possible memory leak if device_add() fails") fixed the memory leak caused by dev_set_name() when device_add() failed. However, it did not consider that 'tgt' has already been released when put_device(&tgt->dev) is called. Remove kfree(tgt) in the error path to avoid double free of 'tgt' and move put_device(&tgt->dev) after the removed kfree(tgt) to avoid a use-after-free. Fixes: 41320b18 ("scsi: snic: Fix possible memory leak if device_add() fails") Signed-off-by:Zhu Wang <wangzhu9@huawei.com> Link: https://lore.kernel.org/r/20230819083941.164365-1-wangzhu9@huawei.com Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
sanglipeng <sanglipeng1@jd.com>
Loading
Please sign in to comment