Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 332ba3b5 authored by James Smart's avatar James Smart Committed by Martin K. Petersen
Browse files

scsi: lpfc: don't dereference dma_buf->iocbq before null check 



From: Colin Ian King <colin.king@canonical.com>

dma_buf->iocbq is being dereferenced immediately before it is
being null checked, so we have a potential null pointer dereference
bug.  Fix this by only dereferencing it only once we have passed
a null check on the pointer.

Detected by CoverityScan, CID#1411652 ("Dereference before null check")

Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarJames Smart <james.smart@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 7aabe84b

drivers/scsi/lpfc/lpfc_mem.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -646,7 +646,6 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba) 
	}

	}





	dma_buf->iocbq = lpfc_sli_get_iocbq(phba);

	dma_buf->iocbq = lpfc_sli_get_iocbq(phba);

	dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;

	if (!dma_buf->iocbq) {

	if (!dma_buf->iocbq) {

		kfree(dma_buf->context);

		kfree(dma_buf->context);

		pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,

		pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
@@ -658,6 +657,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba) 
				"2621 Ran out of nvmet iocb/WQEs\n");

				"2621 Ran out of nvmet iocb/WQEs\n");

		return NULL;

		return NULL;

	}

	}

	dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;

	nvmewqe = dma_buf->iocbq;

	nvmewqe = dma_buf->iocbq;

	wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;

	wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;

	/* Initialize WQE */

	/* Initialize WQE */