From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752657AbdCDRmz (ORCPT ); Sat, 4 Mar 2017 12:42:55 -0500 Received: from mail-wm0-f51.google.com ([74.125.82.51]:37487 "EHLO mail-wm0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752632AbdCDRmv (ORCPT ); Sat, 4 Mar 2017 12:42:51 -0500 Subject: Re: [PATCH] scsi: lpfc: don't dereference dma_buf->iocbq before null check To: Colin King , Dick Kennedy , "James E . J . Bottomley" , "Martin K . Petersen" , linux-scsi@vger.kernel.org References: <20170224140914.6011-1-colin.king@canonical.com> Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org From: James Smart Message-ID: Date: Sat, 4 Mar 2017 09:42:45 -0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <20170224140914.6011-1-colin.king@canonical.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Looks good. I included it in the lpfc patch set just posted. -- james On 2/24/2017 6:09 AM, Colin King wrote: > From: Colin Ian King > > dma_buf->iocbq is being dereferenced immediately before it is > being null checked, so we have a potential null pointer dereference > bug. Fix this by only dereferencing it only once we have passed > a null check on the pointer. > > Detected by CoverityScan, CID#1411652 ("Dereference before null check") > > Signed-off-by: Colin Ian King > --- > drivers/scsi/lpfc/lpfc_mem.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c > index c61d8d6..5986c79 100644 > --- a/drivers/scsi/lpfc/lpfc_mem.c > +++ b/drivers/scsi/lpfc/lpfc_mem.c > @@ -646,7 +646,6 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba) > } > > dma_buf->iocbq = lpfc_sli_get_iocbq(phba); > - dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET; > if (!dma_buf->iocbq) { > kfree(dma_buf->context); > pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt, > @@ -658,6 +657,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba) > "2621 Ran out of nvmet iocb/WQEs\n"); > return NULL; > } > + dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET; > nvmewqe = dma_buf->iocbq; > wqe = (union lpfc_wqe128 *)&nvmewqe->wqe; > /* Initialize WQE */