Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 090305c3 authored by Wenchao Hao's avatar Wenchao Hao Committed by Greg Kroah-Hartman
Browse files

scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() 



[ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ]

Port is allocated by sas_port_alloc_num() and rphy is allocated by either
sas_end_device_alloc() or sas_expander_alloc(), all of which may return
NULL. So we need to check the rphy to avoid possible NULL pointer access.

If sas_rphy_add() returned with failure, rphy is set to NULL. We would
access the rphy in the following lines which would also result NULL pointer
access.

Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()")
Signed-off-by: default avatarWenchao Hao <haowenchao2@huawei.com>
Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com


Acked-by: default avatarSathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent b8849e31

drivers/scsi/mpt3sas/mpt3sas_transport.c

+12 −2
Original line number Diff line number Diff line
@@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, 
		goto out_fail;

	}

	port = sas_port_alloc_num(sas_node->parent_dev);

	if ((sas_port_add(port))) {

	if (!port || (sas_port_add(port))) {

		ioc_err(ioc, "failure at %s:%d/%s()!\n",

			__FILE__, __LINE__, __func__);

		goto out_fail;
@@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, 
		rphy = sas_expander_alloc(port,

		    mpt3sas_port->remote_identify.device_type);



	if (!rphy) {

		ioc_err(ioc, "failure at %s:%d/%s()!\n",

			__FILE__, __LINE__, __func__);

		goto out_delete_port;

	}



	rphy->identify = mpt3sas_port->remote_identify;



	if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) {
@@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, 
			__FILE__, __LINE__, __func__);

		sas_rphy_free(rphy);

		rphy = NULL;

		goto out_delete_port;

	}



	if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) {
@@ -741,6 +748,9 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, 
		    rphy_to_expander_device(rphy));

	return mpt3sas_port;



out_delete_port:

	sas_port_delete(port);



out_fail:

	list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,

	    port_siblings)