aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorAnirban Chakraborty <anirban.chakraborty@qlogic.com>2009-09-28 16:52:58 -0400
committerJames Bottomley <James.Bottomley@suse.de>2009-10-02 15:13:04 -0400
commitc7922a911c42c5a8bdee6cc75eb6bd66937d4217 (patch)
tree5afe423e0e91624289b6a09af8268cc6896994d3 /drivers
parent2c2ed8bfd899b84ecbf71d28fcc2cc4ace36c8d9 (diff)
[SCSI] qla2xxx: Fix NULL ptr deref bug in fail path during queue create
Current code attempts to clean up resources when queue create fails and there it invokes queue free call with a (NULL) pointer to the queue which could not be allocated in the first place. Fix it by returning directly without invoking the queue free call as no resources has been allocated at that point of time. Reported-by: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/scsi/qla2xxx/qla_mid.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index 42b799abba57..e07b3617f019 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -568,7 +568,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options,
568 if (req == NULL) { 568 if (req == NULL) {
569 qla_printk(KERN_WARNING, ha, "could not allocate memory" 569 qla_printk(KERN_WARNING, ha, "could not allocate memory"
570 "for request que\n"); 570 "for request que\n");
571 goto que_failed; 571 goto failed;
572 } 572 }
573 573
574 req->length = REQUEST_ENTRY_CNT_24XX; 574 req->length = REQUEST_ENTRY_CNT_24XX;
@@ -632,6 +632,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options,
632 632
633que_failed: 633que_failed:
634 qla25xx_free_req_que(base_vha, req); 634 qla25xx_free_req_que(base_vha, req);
635failed:
635 return 0; 636 return 0;
636} 637}
637 638
@@ -659,7 +660,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
659 if (rsp == NULL) { 660 if (rsp == NULL) {
660 qla_printk(KERN_WARNING, ha, "could not allocate memory for" 661 qla_printk(KERN_WARNING, ha, "could not allocate memory for"
661 " response que\n"); 662 " response que\n");
662 goto que_failed; 663 goto failed;
663 } 664 }
664 665
665 rsp->length = RESPONSE_ENTRY_CNT_MQ; 666 rsp->length = RESPONSE_ENTRY_CNT_MQ;
@@ -728,6 +729,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
728 729
729que_failed: 730que_failed:
730 qla25xx_free_rsp_que(base_vha, rsp); 731 qla25xx_free_rsp_que(base_vha, rsp);
732failed:
731 return 0; 733 return 0;
732} 734}
733 735