[S390] cio: fix double free in case of probe failure
io_subchannel_probe() frees memory for sch->private which is later freed again when io_subchannel_remove() is called. Fix this problem by removing the cleanup in io_subchannel_probe(). Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
parent
cf87b7439e
commit
48e4c385c5
1 changed files with 5 additions and 6 deletions
|
@ -1292,7 +1292,7 @@ static int io_subchannel_probe(struct subchannel *sch)
|
|||
sch->private = kzalloc(sizeof(struct io_subchannel_private),
|
||||
GFP_KERNEL | GFP_DMA);
|
||||
if (!sch->private)
|
||||
goto out_err;
|
||||
goto out_schedule;
|
||||
/*
|
||||
* First check if a fitting device may be found amongst the
|
||||
* disconnected devices or in the orphanage.
|
||||
|
@ -1317,7 +1317,7 @@ static int io_subchannel_probe(struct subchannel *sch)
|
|||
}
|
||||
cdev = io_subchannel_create_ccwdev(sch);
|
||||
if (IS_ERR(cdev))
|
||||
goto out_err;
|
||||
goto out_schedule;
|
||||
rc = io_subchannel_recog(cdev, sch);
|
||||
if (rc) {
|
||||
spin_lock_irqsave(sch->lock, flags);
|
||||
|
@ -1325,9 +1325,7 @@ static int io_subchannel_probe(struct subchannel *sch)
|
|||
spin_unlock_irqrestore(sch->lock, flags);
|
||||
}
|
||||
return 0;
|
||||
out_err:
|
||||
kfree(sch->private);
|
||||
sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
|
||||
|
||||
out_schedule:
|
||||
io_subchannel_schedule_removal(sch);
|
||||
return 0;
|
||||
|
@ -1341,13 +1339,14 @@ io_subchannel_remove (struct subchannel *sch)
|
|||
|
||||
cdev = sch_get_cdev(sch);
|
||||
if (!cdev)
|
||||
return 0;
|
||||
goto out_free;
|
||||
/* Set ccw device to not operational and drop reference. */
|
||||
spin_lock_irqsave(cdev->ccwlock, flags);
|
||||
sch_set_cdev(sch, NULL);
|
||||
cdev->private->state = DEV_STATE_NOT_OPER;
|
||||
spin_unlock_irqrestore(cdev->ccwlock, flags);
|
||||
ccw_device_unregister(cdev);
|
||||
out_free:
|
||||
kfree(sch->private);
|
||||
sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
|
||||
return 0;
|
||||
|
|
Reference in a new issue