Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e0824e69 authored by Joe Carnuccio's avatar Joe Carnuccio Committed by Martin K. Petersen
Browse files

scsi: qla2xxx: Prevent sp->free null/uninitialized pointer dereference. 



Signed-off-by: default avatarJoe Carnuccio <joe.carnuccio@cavium.com>
Signed-off-by: default avatarHimanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent e4e3a2ce

drivers/scsi/qla2xxx/qla_init.c

+6 −6
Original line number Diff line number Diff line
@@ -808,6 +808,12 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt) 
	if (!sp)

		goto done;



	sp->type = SRB_MB_IOCB;

	sp->name = "gpdb";

	sp->gen1 = fcport->rscn_gen;

	sp->gen2 = fcport->login_gen;

	qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);



	pd = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &pd_dma);

	if (pd == NULL) {

		ql_log(ql_log_warn, vha, 0xd043,
@@ -816,12 +822,6 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt) 
	}

	memset(pd, 0, max(PORT_DATABASE_SIZE, PORT_DATABASE_24XX_SIZE));



	sp->type = SRB_MB_IOCB;

	sp->name = "gpdb";

	sp->gen1 = fcport->rscn_gen;

	sp->gen2 = fcport->login_gen;

	qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);



	mb = sp->u.iocb_cmd.u.mbx.out_mb;

	mb[0] = MBC_GET_PORT_DATABASE;

	mb[1] = fcport->loop_id;

drivers/scsi/qla2xxx/qla_mr.c

+4 −3
Original line number Diff line number Diff line
@@ -1819,6 +1819,10 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type) 
	if (!sp)

		goto done;



	sp->type = SRB_FXIOCB_DCMD;

	sp->name = "fxdisc";

	qla2x00_init_timer(sp, FXDISC_TIMEOUT);



	fdisc = &sp->u.iocb_cmd;

	switch (fx_type) {

	case FXDISC_GET_CONFIG_INFO:
@@ -1920,9 +1924,6 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type) 
			goto done_unmap_req;

	}



	sp->type = SRB_FXIOCB_DCMD;

	sp->name = "fxdisc";

	qla2x00_init_timer(sp, FXDISC_TIMEOUT);

	fdisc->timeout = qla2x00_fxdisc_iocb_timeout;

	fdisc->u.fxiocb.req_func_type = cpu_to_le16(fx_type);

	sp->done = qla2x00_fxdisc_sp_done;