From: Anirban Chakraborty Date: Mon, 28 Sep 2009 20:52:58 +0000 (-0700) Subject: [SCSI] qla2xxx: Fix NULL ptr deref bug in fail path during queue create X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=c7922a911c42c5a8bdee6cc75eb6bd66937d4217;p=deliverable%2Flinux.git [SCSI] qla2xxx: Fix NULL ptr deref bug in fail path during queue create Current code attempts to clean up resources when queue create fails and there it invokes queue free call with a (NULL) pointer to the queue which could not be allocated in the first place. Fix it by returning directly without invoking the queue free call as no resources has been allocated at that point of time. Reported-by: Jiri Slaby Signed-off-by: Anirban Chakraborty Signed-off-by: James Bottomley --- diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 42b799abba57..e07b3617f019 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -568,7 +568,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options, if (req == NULL) { qla_printk(KERN_WARNING, ha, "could not allocate memory" "for request que\n"); - goto que_failed; + goto failed; } req->length = REQUEST_ENTRY_CNT_24XX; @@ -632,6 +632,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options, que_failed: qla25xx_free_req_que(base_vha, req); +failed: return 0; } @@ -659,7 +660,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, if (rsp == NULL) { qla_printk(KERN_WARNING, ha, "could not allocate memory for" " response que\n"); - goto que_failed; + goto failed; } rsp->length = RESPONSE_ENTRY_CNT_MQ; @@ -728,6 +729,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, que_failed: qla25xx_free_rsp_que(base_vha, rsp); +failed: return 0; }