There are some code paths that go to err_free after already calling kfree(hdr_buf). I moved the kfree() lower to avoid the double free. Signed-off-by: Dan Carpenter <error27@xxxxxxxxx> Cc: stable@xxxxxxxxxx --- orig/drivers/scsi/ses.c 2010-01-18 21:54:14.000000000 +0300 +++ devel/drivers/scsi/ses.c 2010-01-18 21:54:25.000000000 +0300 @@ -591,7 +591,6 @@ static int ses_intf_add(struct device *c ses_dev->page10_len = len; buf = NULL; } - kfree(hdr_buf); scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL); if (!scomp) @@ -618,6 +617,7 @@ static int ses_intf_add(struct device *c ses_match_to_enclosure(edev, tmp_sdev); } + kfree(hdr_buf); return 0; recv_failed: -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
