Commit 66e05225 authored by Brian King's avatar Brian King Committed by Linus Torvalds
Browse files

[PATCH] Fix SCSI scanning slab corruption



There is a double free in the scsi scan code if a LLDD's slave_alloc()
call fails.  There is a direct call to scsi_free_queue and then the
following put_device calls the release function, which also frees the
queue.

Remove the redundant scsi_free_queue.

Signed-off-by: default avatarBrian King <brking@us.ibm.com>
Tested-by: default avatarNathan Lynch <ntl@pobox.com>
[ Also removed some strange whitespace artifacts in that area ]
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 49d7bc64
...@@ -266,8 +266,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, ...@@ -266,8 +266,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
/* /*
* if LLDD reports slave not present, don't clutter * if LLDD reports slave not present, don't clutter
* console with alloc failure messages * console with alloc failure messages
*/ */
if (ret == -ENXIO) if (ret == -ENXIO)
display_failure_msg = 0; display_failure_msg = 0;
...@@ -279,7 +277,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, ...@@ -279,7 +277,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
out_device_destroy: out_device_destroy:
transport_destroy_device(&sdev->sdev_gendev); transport_destroy_device(&sdev->sdev_gendev);
scsi_free_queue(sdev->request_queue);
put_device(&sdev->sdev_gendev); put_device(&sdev->sdev_gendev);
out: out:
if (display_failure_msg) if (display_failure_msg)
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment