提交 c7922a91 编写于 作者: A Anirban Chakraborty 提交者: James Bottomley

[SCSI] qla2xxx: Fix NULL ptr deref bug in fail path during queue create

Current code attempts to clean up resources when queue create fails and there it
invokes queue free call with a (NULL) pointer to the queue which could not be
allocated in the first place. Fix it by returning directly without invoking the
queue free call as no resources has been allocated at that point of time.
Reported-by: NJiri Slaby <jirislaby@gmail.com>
Signed-off-by: NAnirban Chakraborty <anirban.chakraborty@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>
上级 2c2ed8bf
......@@ -568,7 +568,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options,
if (req == NULL) {
qla_printk(KERN_WARNING, ha, "could not allocate memory"
"for request que\n");
goto que_failed;
goto failed;
}
req->length = REQUEST_ENTRY_CNT_24XX;
......@@ -632,6 +632,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options,
que_failed:
qla25xx_free_req_que(base_vha, req);
failed:
return 0;
}
......@@ -659,7 +660,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
if (rsp == NULL) {
qla_printk(KERN_WARNING, ha, "could not allocate memory for"
" response que\n");
goto que_failed;
goto failed;
}
rsp->length = RESPONSE_ENTRY_CNT_MQ;
......@@ -728,6 +729,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
que_failed:
qla25xx_free_rsp_que(base_vha, rsp);
failed:
return 0;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册