aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/scsi/scsi_scan.c
diff options
context:
space:
mode:
authorBrian King <brking@us.ibm.com>2005-12-12 14:05:08 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2005-12-12 15:35:39 -0500
commit66e05225262cd9271fac13fe2fd1e9edb65e3978 (patch)
treed2eefc27030003707b7c230897d206c8dfbeda6f /drivers/scsi/scsi_scan.c
parent49d7bc64283970ee83d2c954d04ba00d04e5943d (diff)
[PATCH] Fix SCSI scanning slab corruption
There is a double free in the scsi scan code if a LLDD's slave_alloc() call fails. There is a direct call to scsi_free_queue and then the following put_device calls the release function, which also frees the queue. Remove the redundant scsi_free_queue. Signed-off-by: Brian King <brking@us.ibm.com> Tested-by: Nathan Lynch <ntl@pobox.com> [ Also removed some strange whitespace artifacts in that area ] Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/scsi/scsi_scan.c')
-rw-r--r--drivers/scsi/scsi_scan.c3
1 files changed, 0 insertions, 3 deletions
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 374853df9cca..94e5167f260d 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -266,8 +266,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
266 /* 266 /*
267 * if LLDD reports slave not present, don't clutter 267 * if LLDD reports slave not present, don't clutter
268 * console with alloc failure messages 268 * console with alloc failure messages
269
270
271 */ 269 */
272 if (ret == -ENXIO) 270 if (ret == -ENXIO)
273 display_failure_msg = 0; 271 display_failure_msg = 0;
@@ -279,7 +277,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
279 277
280out_device_destroy: 278out_device_destroy:
281 transport_destroy_device(&sdev->sdev_gendev); 279 transport_destroy_device(&sdev->sdev_gendev);
282 scsi_free_queue(sdev->request_queue);
283 put_device(&sdev->sdev_gendev); 280 put_device(&sdev->sdev_gendev);
284out: 281out:
285 if (display_failure_msg) 282 if (display_failure_msg)