From: Dan Carpenter Date: Mon, 13 Sep 2010 12:09:33 +0000 (+0200) Subject: cciss: freeing uninitialized data on error path X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=b0722cb1ac84863f57471d2b254457c100319300;p=mv-sheeva.git cciss: freeing uninitialized data on error path The "h->scatter_list" is allocated inside a for loop. If any of those allocations fail, then the rest of the list is uninitialized data. When we free it we should start from the top and free backwards so that we don't call kfree() on uninitialized pointers. Also if the allocation for "h->scatter_list" fails then we would get an Oops here. I should have noticed this when I send: 4ee69851c "cciss: handle allocation failure." but I didn't. Sorry about that. Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe --- diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c index 6124c2fd2d3..5e4fadcdece 100644 --- a/drivers/block/cciss.c +++ b/drivers/block/cciss.c @@ -4792,7 +4792,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev, clean4: kfree(h->cmd_pool_bits); /* Free up sg elements */ - for (k = 0; k < h->nr_cmds; k++) + for (k-- ; k >= 0; k--) kfree(h->scatter_list[k]); kfree(h->scatter_list); cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);