Commit a2ee3f9b authored by Stefan Richter's avatar Stefan Richter
Browse files

ieee1394: sbp2: fix sbp2_remove_device for error cases 



Bug found by Olaf Hering <olh@suse.de>:
sbp2util_remove_command_orb_pool requires a valid lu->hi pointer.

Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
parent d1caeb02

drivers/ieee1394/sbp2.c

+7 −7
Original line number Diff line number Diff line
@@ -513,9 +513,9 @@ static int sbp2util_create_command_orb_pool(struct sbp2_lu *lu) 
	return 0;

}



static void sbp2util_remove_command_orb_pool(struct sbp2_lu *lu)

static void sbp2util_remove_command_orb_pool(struct sbp2_lu *lu,

					     struct hpsb_host *host)

{

	struct hpsb_host *host = lu->hi->host;

	struct list_head *lh, *next;

	struct sbp2_command_info *cmd;

	unsigned long flags;
@@ -922,15 +922,16 @@ static void sbp2_remove_device(struct sbp2_lu *lu) 


	if (!lu)

		return;



	hi = lu->hi;

	if (!hi)

		goto no_hi;



	if (lu->shost) {

		scsi_remove_host(lu->shost);

		scsi_host_put(lu->shost);

	}

	flush_scheduled_work();

	sbp2util_remove_command_orb_pool(lu);

	sbp2util_remove_command_orb_pool(lu, hi->host);



	list_del(&lu->lu_list);
@@ -971,9 +972,8 @@ static void sbp2_remove_device(struct sbp2_lu *lu) 


	lu->ud->device.driver_data = NULL;



	if (hi)

	module_put(hi->host->driver->owner);



no_hi:

	kfree(lu);

}