aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/s390/cio/device.c
diff options
context:
space:
mode:
authorPeter Oberparleiter <peter.oberparleiter@de.ibm.com>2009-12-07 12:51:15 +0100
committerMartin Schwidefsky <sky@mschwide.boeblingen.de.ibm.com>2009-12-07 12:51:29 +0100
commit48e4c385c5f54626651cca027afe242439281899 (patch)
treea2c2b698726fcc0f5b03ee49058fad25c48a746f /drivers/s390/cio/device.c
parentcf87b7439ec81b9374e7772e44e9cb2eb9e57160 (diff)
downloadkernel_samsung_smdk4412-48e4c385c5f54626651cca027afe242439281899.zip
kernel_samsung_smdk4412-48e4c385c5f54626651cca027afe242439281899.tar.gz
kernel_samsung_smdk4412-48e4c385c5f54626651cca027afe242439281899.tar.bz2
[S390] cio: fix double free in case of probe failure
io_subchannel_probe() frees memory for sch->private which is later freed again when io_subchannel_remove() is called. Fix this problem by removing the cleanup in io_subchannel_probe(). Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Diffstat (limited to 'drivers/s390/cio/device.c')
-rw-r--r--drivers/s390/cio/device.c11
1 files changed, 5 insertions, 6 deletions
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 2490b74..55f9973 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1292,7 +1292,7 @@ static int io_subchannel_probe(struct subchannel *sch)
sch->private = kzalloc(sizeof(struct io_subchannel_private),
GFP_KERNEL | GFP_DMA);
if (!sch->private)
- goto out_err;
+ goto out_schedule;
/*
* First check if a fitting device may be found amongst the
* disconnected devices or in the orphanage.
@@ -1317,7 +1317,7 @@ static int io_subchannel_probe(struct subchannel *sch)
}
cdev = io_subchannel_create_ccwdev(sch);
if (IS_ERR(cdev))
- goto out_err;
+ goto out_schedule;
rc = io_subchannel_recog(cdev, sch);
if (rc) {
spin_lock_irqsave(sch->lock, flags);
@@ -1325,9 +1325,7 @@ static int io_subchannel_probe(struct subchannel *sch)
spin_unlock_irqrestore(sch->lock, flags);
}
return 0;
-out_err:
- kfree(sch->private);
- sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
+
out_schedule:
io_subchannel_schedule_removal(sch);
return 0;
@@ -1341,13 +1339,14 @@ io_subchannel_remove (struct subchannel *sch)
cdev = sch_get_cdev(sch);
if (!cdev)
- return 0;
+ goto out_free;
/* Set ccw device to not operational and drop reference. */
spin_lock_irqsave(cdev->ccwlock, flags);
sch_set_cdev(sch, NULL);
cdev->private->state = DEV_STATE_NOT_OPER;
spin_unlock_irqrestore(cdev->ccwlock, flags);
ccw_device_unregister(cdev);
+out_free:
kfree(sch->private);
sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
return 0;