Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 552523dc authored by Dan Carpenter's avatar Dan Carpenter Committed by Nicholas Bellinger
Browse files

target: Fix ERR_PTR dereferencing bugs 



transport_init_session() and core_tmr_alloc_req() never return NULL,
they only return ERR_PTRs on error.

v2: Fix patch to return PTR_ERR(tl_nexus->se_sess) from Ankit Jain's
feedback.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarAnkit Jain <jankit@suse.de>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 23388864

drivers/target/loopback/tcm_loop.c

+6 −3
Original line number Diff line number Diff line
@@ -386,7 +386,7 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc) 
	 */

	se_cmd->se_tmr_req = core_tmr_alloc_req(se_cmd, (void *)tl_tmr,

				TMR_LUN_RESET);

	if (!se_cmd->se_tmr_req)

	if (IS_ERR(se_cmd->se_tmr_req))

		goto release;

	/*

	 * Locate the underlying TCM struct se_lun from sc->device->lun
@@ -1017,6 +1017,7 @@ static int tcm_loop_make_nexus( 
	struct se_portal_group *se_tpg;

	struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;

	struct tcm_loop_nexus *tl_nexus;

	int ret = -ENOMEM;



	if (tl_tpg->tl_hba->tl_nexus) {

		printk(KERN_INFO "tl_tpg->tl_hba->tl_nexus already exists\n");
@@ -1033,8 +1034,10 @@ static int tcm_loop_make_nexus( 
	 * Initialize the struct se_session pointer

	 */

	tl_nexus->se_sess = transport_init_session();

	if (!tl_nexus->se_sess)

	if (IS_ERR(tl_nexus->se_sess)) {

		ret = PTR_ERR(tl_nexus->se_sess);

		goto out;

	}

	/*

	 * Since we are running in 'demo mode' this call with generate a

	 * struct se_node_acl for the tcm_loop struct se_portal_group with the SCSI
@@ -1060,7 +1063,7 @@ static int tcm_loop_make_nexus( 


out:

	kfree(tl_nexus);

	return -ENOMEM;

	return ret;

}



static int tcm_loop_drop_nexus(

drivers/target/tcm_fc/tfc_sess.c

+1 −1
Original line number Diff line number Diff line
@@ -229,7 +229,7 @@ static struct ft_sess *ft_sess_create(struct ft_tport *tport, u32 port_id, 
		return NULL;



	sess->se_sess = transport_init_session();

	if (!sess->se_sess) {

	if (IS_ERR(sess->se_sess)) {

		kfree(sess);

		return NULL;

	}