2006-10-01 20:31:58

by Eric Sesterhenn

Subject: [Patch] Dereference in drivers/scsi/lpfc/lpfc_ct.c

hi,

if we fail to allocate mp->virt during the first while
loop iteration, mlist is still uninitialized, therefore
we should check if before dereferencing.

Signed-off-by: Eric Sesterhenn <[email protected]>

--- linux-2.6.18-git16/drivers/scsi/lpfc/lpfc_ct.c.orig 2006-10-01 22:28:37.000000000 +0200
+++ linux-2.6.18-git16/drivers/scsi/lpfc/lpfc_ct.c 2006-10-01 22:29:10.000000000 +0200
@@ -188,7 +188,8 @@ lpfc_alloc_ct_rsp(struct lpfc_hba * phba

if (!mp->virt) {
kfree(mp);
- lpfc_free_ct_rsp(phba, mlist);
+ if (mlist)
+ lpfc_free_ct_rsp(phba, mlist);
return NULL;
}

2006-10-02 15:37:59

by James Smart

Subject: Re: [Patch] Dereference in drivers/scsi/lpfc/lpfc_ct.c

ACK - good fix.

-- james s

Eric Sesterhenn wrote:
> hi,
>
> if we fail to allocate mp->virt during the first while
> loop iteration, mlist is still uninitialized, therefore
> we should check if before dereferencing.
>
> Signed-off-by: Eric Sesterhenn <[email protected]>
>
> --- linux-2.6.18-git16/drivers/scsi/lpfc/lpfc_ct.c.orig 2006-10-01 22:28:37.000000000 +0200
> +++ linux-2.6.18-git16/drivers/scsi/lpfc/lpfc_ct.c 2006-10-01 22:29:10.000000000 +0200
> @@ -188,7 +188,8 @@ lpfc_alloc_ct_rsp(struct lpfc_hba * phba
>
> if (!mp->virt) {
> kfree(mp);
> - lpfc_free_ct_rsp(phba, mlist);
> + if (mlist)
> + lpfc_free_ct_rsp(phba, mlist);
> return NULL;
> }
>
>
>
>