When goto the mem_alloc_failure, it will result in a null pointer
reference to variable 'gl' in function 'qedi_free_global_queues',
due to the 'qedi->global_queues' not being allocated.
Fix this by returning -EINVAL directly.
Signed-off-by: Peizhi Li <[email protected]>
Reviewed-by: Dongliang Mu <[email protected]>
Reviewed-by: Dan Carpenter <[email protected]>
---
The issue is found by static analysis and remains untested. Meanwhile,
this patches is similar with qedf which Jinhong Zhu fixed already.
https://lore.kernel.org/all/[email protected]/
drivers/scsi/qedi/qedi_main.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index f2ee49756df8..34f38e0f1c7d 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1637,8 +1637,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
* addresses of our queues
*/
if (!qedi->p_cpuq) {
- status = -EINVAL;
- goto mem_alloc_failure;
+ return -EINVAL;
}
qedi->global_queues = kzalloc((sizeof(struct global_queue *) *
--
2.25.1
> -----Original Message-----
> From: Peizhi Li <[email protected]>
> Sent: Saturday, April 22, 2023 3:46 PM
> To: Nilesh Javali <[email protected]>; Manish Rangankar
> <[email protected]>; GR-QLogic-Storage-Upstream <GR-QLogic-
> [email protected]>; James E.J. Bottomley
> <[email protected]>; Martin K. Petersen <[email protected]>
> Cc: [email protected]; Peizhi Li
> <[email protected]>; Dongliang Mu <[email protected]>; Dan
> Carpenter <[email protected]>; [email protected]; linux-
> [email protected]
> Subject: [EXT] [PATCH] scsi: qedi: qedi_main.c: modify the code flow in
> 'qedi_alloc_global_queues'
>
> External Email
>
> ----------------------------------------------------------------------
> When goto the mem_alloc_failure, it will result in a null pointer reference to
> variable 'gl' in function 'qedi_free_global_queues', due to the 'qedi-
> >global_queues' not being allocated.
>
> Fix this by returning -EINVAL directly.
>
> Signed-off-by: Peizhi Li <[email protected]>
> Reviewed-by: Dongliang Mu <[email protected]>
> Reviewed-by: Dan Carpenter <[email protected]>
> ---
> The issue is found by static analysis and remains untested. Meanwhile, this
> patches is similar with qedf which Jinhong Zhu fixed already.
>
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__lore.kernel.org_all_20230417135518.184595-2D1-2Djinhongzhu-
> 40hust.edu.cn_&d=DwIDAg&c=nKjWec2b6R0mOyPaz7xtfQ&r=At6ko6G2bm
> E5NMB-6KMSliwRneAzZrOmmK21YHGCrqw&m=5ieD0l90bssMZBp8xnyd-
> eE3D1n_4P8CQfuaR8BW1hauGGhRlK891lfcT4e-
> UAyo&s=DshVk_3xiEVzwIyxpk90ObNr4U4lx6daDaS3uuN6t6g&e=
> drivers/scsi/qedi/qedi_main.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
> index f2ee49756df8..34f38e0f1c7d 100644
> --- a/drivers/scsi/qedi/qedi_main.c
> +++ b/drivers/scsi/qedi/qedi_main.c
> @@ -1637,8 +1637,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx
> *qedi)
> * addresses of our queues
> */
> if (!qedi->p_cpuq) {
> - status = -EINVAL;
> - goto mem_alloc_failure;
> + return -EINVAL;
> }
>
> qedi->global_queues = kzalloc((sizeof(struct global_queue *) *
> --
> 2.25.1
Thanks,
Acked-by: Manish Rangankar <[email protected]>
On 4/22/23 5:16 AM, Peizhi Li wrote:
> When goto the mem_alloc_failure, it will result in a null pointer
> reference to variable 'gl' in function 'qedi_free_global_queues',
> due to the 'qedi->global_queues' not being allocated.
>
> Fix this by returning -EINVAL directly.
>
> Signed-off-by: Peizhi Li <[email protected]>
> Reviewed-by: Dongliang Mu <[email protected]>
> Reviewed-by: Dan Carpenter <[email protected]>
> ---
> The issue is found by static analysis and remains untested. Meanwhile,
> this patches is similar with qedf which Jinhong Zhu fixed already.
>
> https://lore.kernel.org/all/[email protected]/
> drivers/scsi/qedi/qedi_main.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
> index f2ee49756df8..34f38e0f1c7d 100644
> --- a/drivers/scsi/qedi/qedi_main.c
> +++ b/drivers/scsi/qedi/qedi_main.c
> @@ -1637,8 +1637,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
> * addresses of our queues
> */
> if (!qedi->p_cpuq) {
> - status = -EINVAL;
> - goto mem_alloc_failure;
> + return -EINVAL;
> }
>
The patch looks ok:
Reviewed-by: Mike Christie <[email protected]>
Looks like there is another issue in this code path though. If
qedi_alloc_global_queues fails in qedi_set_iscsi_pf_param the err_alloc_mem
goto just ends up returning, so the p_cpuq allocation a couple lines before
the qedi_set_iscsi_pf_param call will be leaked.
The __qedi_probe call to qedi_set_iscsi_pf_param just frees the iscsi host,
so it won't be freed via a qedi_free_iscsi_pf_param later. So, I think
qedi_set_iscsi_pf_param's err_alloc_mem goto handler should free the p_cpuq.
On 2023/4/25 16:51, Dan Carpenter wrote:
> Heh. Let's not send these robot emails to the dev lists.
Dan,
Really sorry about this embarrassing situation. We don't intend to flood
any emails to LKML.
Our robot development introduced a logic error in checking if patches
are sent out to LKML.This robot should only check the patches sent to
this internal review mailing list, instead of patches sent to LKML.
I spent hours today to write say-sorry emails about our mistake. :(
Dongliang Mu
>
> Regards,
> Dan Carpenter
>