cciss: freeing uninitialized data on error path
authorDan Carpenter <error27@gmail.com>
Mon, 13 Sep 2010 12:09:33 +0000 (14:09 +0200)
committerJens Axboe <jaxboe@fusionio.com>
Tue, 21 Sep 2010 09:49:17 +0000 (11:49 +0200)
commitb0722cb1ac84863f57471d2b254457c100319300
tree94baf120e813a169aa1d919dcb160f0d05276241
parent2422084a94fcd5038406261b331672a13c92c050
cciss: freeing uninitialized data on error path

The "h->scatter_list" is allocated inside a for loop.  If any of those
allocations fail, then the rest of the list is uninitialized data.  When
we free it we should start from the top and free backwards so that we
don't call kfree() on uninitialized pointers.

Also if the allocation for "h->scatter_list" fails then we would get an
Oops here.  I should have noticed this when I send: 4ee69851c "cciss:
handle allocation failure."  but I didn't.  Sorry about that.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
drivers/block/cciss.c