hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

scsi: qla2xxx: Prevent sp->free null/uninitialized pointer dereference. 

Signed-off-by: Joe Carnuccio <joe.carnuccio@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Joe Carnuccio 2017-08-23 15:05:08 -07:00 committed by Martin K. Petersen
parent e4e3a2ce95
commit e0824e69bd
2 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/scsi/qla2xxx/qla_init.c
View File

@ -808,6 +808,12 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt)
if (!sp) if (!sp)
goto done; goto done;
sp->type = SRB_MB_IOCB;
sp->name = "gpdb";
sp->gen1 = fcport->rscn_gen;
sp->gen2 = fcport->login_gen;
qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
pd = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &pd_dma); pd = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &pd_dma);
if (pd == NULL) { if (pd == NULL) {
ql_log(ql_log_warn, vha, 0xd043, ql_log(ql_log_warn, vha, 0xd043,
@ -816,12 +822,6 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt)
} }
memset(pd, 0, max(PORT_DATABASE_SIZE, PORT_DATABASE_24XX_SIZE)); memset(pd, 0, max(PORT_DATABASE_SIZE, PORT_DATABASE_24XX_SIZE));
sp->type = SRB_MB_IOCB;
sp->name = "gpdb";
sp->gen1 = fcport->rscn_gen;
sp->gen2 = fcport->login_gen;
qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
mb = sp->u.iocb_cmd.u.mbx.out_mb; mb = sp->u.iocb_cmd.u.mbx.out_mb;
mb[0] = MBC_GET_PORT_DATABASE; mb[0] = MBC_GET_PORT_DATABASE;
mb[1] = fcport->loop_id; mb[1] = fcport->loop_id;

7
drivers/scsi/qla2xxx/qla_mr.c
View File

@ -1819,6 +1819,10 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type)
if (!sp) if (!sp)
goto done; goto done;
sp->type = SRB_FXIOCB_DCMD;
sp->name = "fxdisc";
qla2x00_init_timer(sp, FXDISC_TIMEOUT);
fdisc = &sp->u.iocb_cmd; fdisc = &sp->u.iocb_cmd;
switch (fx_type) { switch (fx_type) {
case FXDISC_GET_CONFIG_INFO: case FXDISC_GET_CONFIG_INFO:
@ -1920,9 +1924,6 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type)
goto done_unmap_req; goto done_unmap_req;
} }
sp->type = SRB_FXIOCB_DCMD;
sp->name = "fxdisc";
qla2x00_init_timer(sp, FXDISC_TIMEOUT);
fdisc->timeout = qla2x00_fxdisc_iocb_timeout; fdisc->timeout = qla2x00_fxdisc_iocb_timeout;
fdisc->u.fxiocb.req_func_type = cpu_to_le16(fx_type); fdisc->u.fxiocb.req_func_type = cpu_to_le16(fx_type);
sp->done = qla2x00_fxdisc_sp_done; sp->done = qla2x00_fxdisc_sp_done;