Ben Hutchings 278993f017 scsi: aacraid: Fix double-free on probe failure ... ANBZ: #11159 commit 919ddf8336 upstream. aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky@gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde8 ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh@debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Fixes: CVE-2024-46673 Signed-off-by: Xiao Long <xiaolong@openanolis.org> Reviewed-by: Guixin Liu <kanie@linux.alibaba.com> Link: https://gitee.com/anolis/cloud-kernel/pulls/3917		2024-10-12 05:49:54 +00:00
..
Makefile	…
TODO	…
aachba.c	…
aacraid.h	…
commctrl.c	scsi: aacraid: Improve compat_ioctl handlers	2020-12-30 11:53:02 +01:00
comminit.c	scsi: aacraid: Fix double-free on probe failure	2024-10-12 05:49:54 +00:00
commsup.c	…
dpcsup.c	…
linit.c	scsi: aacraid: Improve compat_ioctl handlers	2020-12-30 11:53:02 +01:00
nark.c	…
rkt.c	…
rx.c	…
sa.c	…
src.c	…