提交 ada81b74 编写于 作者: C Christof Schmitt 提交者: James Bottomley

[SCSI] zfcp: Dont call zfcp_fsf_req_free on NULL pointer

Fix problem that zfcp_fsf_exchange_config_data_sync and
zfcp_fsf_exchange_config_data_sync could try to call zfcp_fsf_req_free
with a NULL pointer.
Reviewed-by: NMartin Petermann <martin@linux.vnet.ibm.com>
Signed-off-by: NChristof Schmitt <christof.schmitt@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
上级 306b6edc
...@@ -1254,13 +1254,13 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_adapter *adapter, ...@@ -1254,13 +1254,13 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_adapter *adapter,
spin_lock_bh(&adapter->req_q_lock); spin_lock_bh(&adapter->req_q_lock);
if (zfcp_fsf_req_sbal_get(adapter)) if (zfcp_fsf_req_sbal_get(adapter))
goto out; goto out_unlock;
req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_CONFIG_DATA, req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_CONFIG_DATA,
0, NULL); 0, NULL);
if (IS_ERR(req)) { if (IS_ERR(req)) {
retval = PTR_ERR(req); retval = PTR_ERR(req);
goto out; goto out_unlock;
} }
sbale = zfcp_qdio_sbale_req(req); sbale = zfcp_qdio_sbale_req(req);
...@@ -1279,14 +1279,16 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_adapter *adapter, ...@@ -1279,14 +1279,16 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_adapter *adapter,
zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT); zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
retval = zfcp_fsf_req_send(req); retval = zfcp_fsf_req_send(req);
out:
spin_unlock_bh(&adapter->req_q_lock); spin_unlock_bh(&adapter->req_q_lock);
if (!retval) if (!retval)
wait_event(req->completion_wq, wait_event(req->completion_wq,
req->status & ZFCP_STATUS_FSFREQ_COMPLETED); req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
zfcp_fsf_req_free(req); zfcp_fsf_req_free(req);
return retval;
out_unlock:
spin_unlock_bh(&adapter->req_q_lock);
return retval; return retval;
} }
...@@ -1353,13 +1355,13 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_adapter *adapter, ...@@ -1353,13 +1355,13 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_adapter *adapter,
spin_lock_bh(&adapter->req_q_lock); spin_lock_bh(&adapter->req_q_lock);
if (zfcp_fsf_req_sbal_get(adapter)) if (zfcp_fsf_req_sbal_get(adapter))
goto out; goto out_unlock;
req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_PORT_DATA, 0, req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_PORT_DATA, 0,
NULL); NULL);
if (IS_ERR(req)) { if (IS_ERR(req)) {
retval = PTR_ERR(req); retval = PTR_ERR(req);
goto out; goto out_unlock;
} }
if (data) if (data)
...@@ -1372,14 +1374,18 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_adapter *adapter, ...@@ -1372,14 +1374,18 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_adapter *adapter,
req->handler = zfcp_fsf_exchange_port_data_handler; req->handler = zfcp_fsf_exchange_port_data_handler;
zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT); zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
retval = zfcp_fsf_req_send(req); retval = zfcp_fsf_req_send(req);
out:
spin_unlock_bh(&adapter->req_q_lock); spin_unlock_bh(&adapter->req_q_lock);
if (!retval) if (!retval)
wait_event(req->completion_wq, wait_event(req->completion_wq,
req->status & ZFCP_STATUS_FSFREQ_COMPLETED); req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
zfcp_fsf_req_free(req); zfcp_fsf_req_free(req);
return retval; return retval;
out_unlock:
spin_unlock_bh(&adapter->req_q_lock);
return retval;
} }
static void zfcp_fsf_open_port_handler(struct zfcp_fsf_req *req) static void zfcp_fsf_open_port_handler(struct zfcp_fsf_req *req)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册