lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 19 Jul 2021 16:50:14 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org, Justin Tee <justin.tee@...adcom.com>, James Smart <jsmart2021@...il.com>, "Martin K. Petersen" <martin.petersen@...cle.com>, Sasha Levin <sashal@...nel.org> Subject: [PATCH 5.13 068/351] scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize the SGLs From: James Smart <jsmart2021@...il.com> [ Upstream commit 5aa615d195f1e142c662cb2253f057c9baec7531 ] The driver is encountering a crash in lpfc_free_iocb_list() while performing initial attachment. Code review found this to be an errant failure path that was taken, jumping to a tag that then referenced structures that were uninitialized. Fix the failure path. Link: https://lore.kernel.org/r/20210514195559.119853-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee@...adcom.com> Signed-off-by: Justin Tee <justin.tee@...adcom.com> Signed-off-by: James Smart <jsmart2021@...il.com> Signed-off-by: Martin K. Petersen <martin.petersen@...cle.com> Signed-off-by: Sasha Levin <sashal@...nel.org> --- drivers/scsi/lpfc/lpfc_sli.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index bc0bcb0dccc9..9ed826fd53e8 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -7959,7 +7959,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) "0393 Error %d during rpi post operation\n", rc); rc = -ENODEV; - goto out_destroy_queue; + goto out_free_iocblist; } lpfc_sli4_node_prep(phba); @@ -8125,8 +8125,9 @@ out_io_buff_free: out_unset_queue: /* Unset all the queues set up in this routine when error out */ lpfc_sli4_queue_unset(phba); -out_destroy_queue: +out_free_iocblist: lpfc_free_iocb_list(phba); +out_destroy_queue: lpfc_sli4_queue_destroy(phba); out_stop_timers: lpfc_stop_hba_timers(phba); -- 2.30.2
Powered by blists - more mailing lists