aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnirban Chakraborty <anirban.chakraborty@qlogic.com>2009-09-28 13:52:58 -0700
committerJames Bottomley <James.Bottomley@suse.de>2009-10-02 14:13:04 -0500
commitc7922a911c42c5a8bdee6cc75eb6bd66937d4217 (patch)
tree5afe423e0e91624289b6a09af8268cc6896994d3
parent2c2ed8bfd899b84ecbf71d28fcc2cc4ace36c8d9 (diff)
[SCSI] qla2xxx: Fix NULL ptr deref bug in fail path during queue create
Current code attempts to clean up resources when queue create fails and there it invokes queue free call with a (NULL) pointer to the queue which could not be allocated in the first place. Fix it by returning directly without invoking the queue free call as no resources has been allocated at that point of time. Reported-by: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
-rw-r--r--drivers/scsi/qla2xxx/qla_mid.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index 42b799abba5..e07b3617f01 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -568,7 +568,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options,
if (req == NULL) {
qla_printk(KERN_WARNING, ha, "could not allocate memory"
"for request que\n");
- goto que_failed;
+ goto failed;
}
req->length = REQUEST_ENTRY_CNT_24XX;
@@ -632,6 +632,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options,
que_failed:
qla25xx_free_req_que(base_vha, req);
+failed:
return 0;
}
@@ -659,7 +660,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
if (rsp == NULL) {
qla_printk(KERN_WARNING, ha, "could not allocate memory for"
" response que\n");
- goto que_failed;
+ goto failed;
}
rsp->length = RESPONSE_ENTRY_CNT_MQ;
@@ -728,6 +729,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
que_failed:
qla25xx_free_rsp_que(base_vha, rsp);
+failed:
return 0;
}