Skip to contentSkip to conversation

potential null deref in lpfc_els.c

PATCH James Smart 2 participants 2 messages Dec 8, 2009 – Dec 9, 2009 1 message not in the archive

Subsystems (2)
lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): 1260295121.6096.19.camel@wookie

#1 lore raw
Quoted 9 lines

This patch is against 2.6.32-rc8.

The issue was found by a static checker. If cmd==ELS_CMD_PLOGI, it is possible for ndlp to be NULL. We do check ndlp further down the function so that would also indicate that we should check ndlp here.

Compile tested.

Dan,

Thanks. We never hit this as it's code specific to using debugfs, which we don't turn on except for very rare occasions. Anyway, it is an error, so it's worth correcting.

I've updated your patch to change the default value - I wanted to D_ID to be a non-valid value.

-- james s

---

 lpfc_els.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_els.c +2 -1
diff -upNr a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
@@ -2562,7 +2562,8 @@ lpfc_els_retry(struct lpfc_hba *phba, st
 
 	lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD,
 		"Retry ELS:       wd7:x%x wd4:x%x did:x%x",
-		*(((uint32_t *) irsp) + 7), irsp->un.ulpWord[4], ndlp->nlp_DID);
+		*(((uint32_t *) irsp) + 7), irsp->un.ulpWord[4],
+		(ndlp ?  ndlp->nlp_DID : 0xFFFFFFFF));
 
 	switch (irsp->ulpStatus) {
 	case IOSTAT_FCP_RSP_ERROR:
#2 lore raw
Quoted 10 lines · James Smart
Quoted 9 lines

This patch is against 2.6.32-rc8.

The issue was found by a static checker. If cmd==ELS_CMD_PLOGI, it is possible for ndlp to be NULL. We do check ndlp further down the function so that would also indicate that we should check ndlp here.

Compile tested.

Quoted 9 lines

Dan,

Thanks. We never hit this as it's code specific to using debugfs, which we don't turn on except for very rare occasions. Anyway, it is an error, so it's worth correcting.

I've updated your patch to change the default value - I wanted to D_ID to be a non-valid value.

Cool. Thanks, I should have asked you what value you wanted there before.

regards,
dan

Quoted 26 lines

-- james s

---

 lpfc_els.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff -upNr a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c

drivers/scsi/lpfc/lpfc_els.c +2 -1
@@ -2562,7 +2562,8 @@ lpfc_els_retry(struct lpfc_hba *phba, st
 
 	lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD,
 		"Retry ELS:       wd7:x%x wd4:x%x did:x%x",
-		*(((uint32_t *) irsp) + 7), irsp->un.ulpWord[4], ndlp->nlp_DID);
+		*(((uint32_t *) irsp) + 7), irsp->un.ulpWord[4],
+		(ndlp ?  ndlp->nlp_DID : 0xFFFFFFFF));
 
 	switch (irsp->ulpStatus) {
 	case IOSTAT_FCP_RSP_ERROR: