potential null deref in lpfc_els.c
Subsystems (2)
A message that is not in the archive (sent off-list or not yet received): 1260295121.6096.19.camel@wookie
Quoted 9 lines
This patch is against 2.6.32-rc8.
The issue was found by a static checker. If cmd==ELS_CMD_PLOGI, it is possible for ndlp to be NULL. We do check ndlp further down the function so that would also indicate that we should check ndlp here.
Compile tested.
Dan,
Thanks. We never hit this as it's code specific to using debugfs, which we don't turn on except for very rare occasions. Anyway, it is an error, so it's worth correcting.
I've updated your patch to change the default value - I wanted to D_ID to be a non-valid value.
-- james s
---
lpfc_els.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_els.c +2 -1
@@ -2562,7 +2562,8 @@ lpfc_els_retry(struct lpfc_hba *phba, stlpfc_debugfs_disc_trc (vport,LPFC_DISC_TRC_ELS_CMD ,"Retry ELS: wd7:x%x wd4:x%x did:x%x" , - *(((uint32_t *) irsp) +7 ), irsp->un.ulpWord[4 ], ndlp->nlp_DID); + *(((uint32_t *) irsp) +7 ), irsp->un.ulpWord[4 ], + (ndlp ? ndlp->nlp_DID :0xFFFFFFFF ));switch (irsp->ulpStatus) {case IOSTAT_FCP_RSP_ERROR :
Quoted 10 lines · James Smart
Quoted 9 lines
This patch is against 2.6.32-rc8.
The issue was found by a static checker. If cmd==ELS_CMD_PLOGI, it is possible for ndlp to be NULL. We do check ndlp further down the function so that would also indicate that we should check ndlp here.
Compile tested.
Quoted 9 lines
Dan,
Thanks. We never hit this as it's code specific to using debugfs, which we don't turn on except for very rare occasions. Anyway, it is an error, so it's worth correcting.
I've updated your patch to change the default value - I wanted to
D_IDto be a non-valid value.
Cool. Thanks, I should have asked you what value you wanted there before.
regards,
dan
Quoted 26 lines
-- james s
Signed-off-by James Smart <[email protected]>---
lpfc_els.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)diff -upNr
a/drivers/scsi/lpfc/lpfc_els.cb/drivers/scsi/lpfc/lpfc_els.cdrivers/scsi/lpfc/lpfc_els.c +2
-1@@ -2562,7 +2562,8 @@ lpfc_els_retry(struct lpfc_hba *phba, stlpfc_debugfs_disc_trc (vport,LPFC_DISC_TRC_ELS_CMD ,"Retry ELS: wd7:x%x wd4:x%x did:x%x" , - *(((uint32_t *) irsp) +7 ), irsp->un.ulpWord[4 ], ndlp->nlp_DID); + *(((uint32_t *) irsp) +7 ), irsp->un.ulpWord[4 ], + (ndlp ? ndlp->nlp_DID :0xFFFFFFFF ));switch (irsp->ulpStatus) {case IOSTAT_FCP_RSP_ERROR :