[PATCH] scsi: be2iscsi: Fix NULL pointer dereference in memory cleanup

[PATCH] scsi: be2iscsi: Fix NULL pointer dereference in memory cleanup

[mdshahid03]

From: Mohammad Shahid <mdshahid03@gmail.com>

During memory allocation ,DMA memory may be allocated successfully
before the descriptor array allocation fails.

In this case ,mem_descr->mem_array is NULL,but cleanup path tries
to access it.

Use mem_arr_orig to free the DMA allocation of the current
descriptor and handle previously allocated descriptors separately.

Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com>
---
 drivers/scsi/be2iscsi/be_main.c | 34 ++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index fd18d4d3d219..95706b5db7be 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -2549,22 +2549,30 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
 	kfree(mem_arr_orig);
 	return 0;
 free_mem:
-	mem_descr->num_elements = j;
-	while ((i) || (j)) {
+	/* Free DMA allocations of the current descriptor */
+	for (; j > 0; j--) {
+		dma_free_coherent(&phba->pcidev->dev,
+			mem_arr_orig[j - 1].size,
+			mem_arr_orig[j - 1].virtual_address,
+			(unsigned long)
+			mem_arr_orig[j - 1].bus_address.u.a64.address);
+	}
+
+	/* Free previously completed descriptors */
+	while (i > 0) {
+		i--;
+		mem_descr--;
+
 		for (j = mem_descr->num_elements; j > 0; j--) {
 			dma_free_coherent(&phba->pcidev->dev,
-					    mem_descr->mem_array[j - 1].size,
-					    mem_descr->mem_array[j - 1].
-					    virtual_address,
-					    (unsigned long)mem_descr->
-					    mem_array[j - 1].
-					    bus_address.u.a64.address);
-		}
-		if (i) {
-			i--;
-			kfree(mem_descr->mem_array);
-			mem_descr--;
+				mem_descr->mem_array[j - 1].size,
+				mem_descr->mem_array[j - 1].virtual_address,
+				(unsigned long)
+				mem_descr->mem_array[j - 1].bus_address.u.a64.address);
 		}
+
+		kfree(mem_descr->mem_array);
+
 	}
 	kfree(mem_arr_orig);
 	kfree(phba->init_mem);
-- 
2.43.0