Commit f96d279f authored Aug 20, 2019 by zhengbin Committed by Martin K. Petersen Sep 10, 2019

scsi: fcoe: fix null-ptr-deref Read in fc_release_transport

In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions)
fails, need to free the previously memory and return fail, otherwise
will trigger null-ptr-deref Read in fc_release_transport.

fcoe_exit
  fcoe_if_exit
    fc_release_transport(fcoe_vport_scsi_transport)

Link: https://lore.kernel.org/r/1566279789-58207-1-git-send-email-zhengbin13@huawei.com


Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: zhengbin <zhengbin13@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

parent 7ce5eed0

drivers/scsi/fcoe/fcoe.c

+11 −5

Original line number	Diff line number	Diff line
		@@ -1250,17 +1250,23 @@ static int __init fcoe_if_init(void)
		/* attach to scsi transport */
		fcoe_nport_scsi_transport =
		fc_attach_transport(&fcoe_nport_fc_functions);
		if (!fcoe_nport_scsi_transport)
		goto err;

		fcoe_vport_scsi_transport =
		fc_attach_transport(&fcoe_vport_fc_functions);
		if (!fcoe_vport_scsi_transport)
		goto err_vport;

		if (!fcoe_nport_scsi_transport) {
		return 0;

		err_vport:
		fc_release_transport(fcoe_nport_scsi_transport);
		err:
		printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n");
		return -ENODEV;
		}

		return 0;
		}

		/**
		* fcoe_if_exit() - Tear down fcoe.ko
		*