summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2010-09-13 14:09:33 +0200
committerJens Axboe <jaxboe@fusionio.com>2010-09-21 11:49:17 +0200
commitb0722cb1ac84863f57471d2b254457c100319300 (patch)
tree94baf120e813a169aa1d919dcb160f0d05276241
parent2422084a94fcd5038406261b331672a13c92c050 (diff)
cciss: freeing uninitialized data on error path
The "h->scatter_list" is allocated inside a for loop. If any of those allocations fail, then the rest of the list is uninitialized data. When we free it we should start from the top and free backwards so that we don't call kfree() on uninitialized pointers. Also if the allocation for "h->scatter_list" fails then we would get an Oops here. I should have noticed this when I send: 4ee69851c "cciss: handle allocation failure." but I didn't. Sorry about that. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
-rw-r--r--drivers/block/cciss.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 6124c2fd2d33..5e4fadcdece9 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -4792,7 +4792,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
clean4:
kfree(h->cmd_pool_bits);
/* Free up sg elements */
- for (k = 0; k < h->nr_cmds; k++)
+ for (k-- ; k >= 0; k--)
kfree(h->scatter_list[k]);
kfree(h->scatter_list);
cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);