diff options
author | Brian King <brking@us.ibm.com> | 2005-12-12 14:05:08 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-12-12 15:35:39 -0500 |
commit | 66e05225262cd9271fac13fe2fd1e9edb65e3978 (patch) | |
tree | d2eefc27030003707b7c230897d206c8dfbeda6f /drivers/scsi | |
parent | 49d7bc64283970ee83d2c954d04ba00d04e5943d (diff) |
[PATCH] Fix SCSI scanning slab corruption
There is a double free in the scsi scan code if a LLDD's slave_alloc()
call fails. There is a direct call to scsi_free_queue and then the
following put_device calls the release function, which also frees the
queue.
Remove the redundant scsi_free_queue.
Signed-off-by: Brian King <brking@us.ibm.com>
Tested-by: Nathan Lynch <ntl@pobox.com>
[ Also removed some strange whitespace artifacts in that area ]
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/scsi')
-rw-r--r-- | drivers/scsi/scsi_scan.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c index 374853df9cca..94e5167f260d 100644 --- a/drivers/scsi/scsi_scan.c +++ b/drivers/scsi/scsi_scan.c | |||
@@ -266,8 +266,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, | |||
266 | /* | 266 | /* |
267 | * if LLDD reports slave not present, don't clutter | 267 | * if LLDD reports slave not present, don't clutter |
268 | * console with alloc failure messages | 268 | * console with alloc failure messages |
269 | |||
270 | |||
271 | */ | 269 | */ |
272 | if (ret == -ENXIO) | 270 | if (ret == -ENXIO) |
273 | display_failure_msg = 0; | 271 | display_failure_msg = 0; |
@@ -279,7 +277,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, | |||
279 | 277 | ||
280 | out_device_destroy: | 278 | out_device_destroy: |
281 | transport_destroy_device(&sdev->sdev_gendev); | 279 | transport_destroy_device(&sdev->sdev_gendev); |
282 | scsi_free_queue(sdev->request_queue); | ||
283 | put_device(&sdev->sdev_gendev); | 280 | put_device(&sdev->sdev_gendev); |
284 | out: | 281 | out: |
285 | if (display_failure_msg) | 282 | if (display_failure_msg) |