linux-kernel - [PATCH 1/4] scsi: lpfc: Improve exception handling in lpfc_rcv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <562d25d9-9550-4dc2-a7d9-40af3109e3db@web.de>
Date: Thu, 28 Dec 2023 18:22:01 +0100
From: Markus Elfring <Markus.Elfring@....de>
To: linux-scsi@...r.kernel.org, kernel-janitors@...r.kernel.org,
 Dick Kennedy <dick.kennedy@...adcom.com>,
 James Smart <james.smart@...adcom.com>,
 "James E. J. Bottomley" <jejb@...ux.ibm.com>,
 "Martin K. Petersen" <martin.petersen@...cle.com>
Cc: LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH 1/4] scsi: lpfc: Improve exception handling in
 lpfc_rcv_plogi()

From: Markus Elfring <elfring@...rs.sourceforge.net>
Date: Thu, 28 Dec 2023 17:00:07 +0100

The kfree() function was called in one case by the
lpfc_rcv_plogi() function during error handling
even if the passed variable contained a null pointer.
This issue was detected by using the Coccinelle software.

* Thus adjust jump targets.

* Delete three variable assignments and a repeated pointer check
  which became unnecessary with this refactoring.

Signed-off-by: Markus Elfring <elfring@...rs.sourceforge.net>
---
 drivers/scsi/lpfc/lpfc_nportdisc.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index d9074929fbab..2559f2ac7277 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -459,10 +459,6 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 	ndlp->nlp_nvme_info &= ~NLP_NVME_NSLER;
 	ndlp->nlp_flag &= ~NLP_FIRSTBURST;

-	login_mbox = NULL;
-	link_mbox = NULL;
-	save_iocb = NULL;
-
 	/* Check for Nport to NPort pt2pt protocol */
 	if ((vport->fc_flag & FC_PT2PT) &&
 	    !(vport->fc_flag & FC_PT2PT_PLOGI)) {
@@ -509,7 +505,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 			link_mbox = mempool_alloc(phba->mbox_mem_pool,
 						  GFP_KERNEL);
 			if (!link_mbox)
-				goto out;
+				goto reject_response;
 			lpfc_config_link(phba, link_mbox);
 			link_mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
 			link_mbox->vport = vport;
@@ -522,7 +518,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 			rc = lpfc_sli_issue_mbox(phba, link_mbox, MBX_NOWAIT);
 			if (rc == MBX_NOT_FINISHED) {
 				mempool_free(link_mbox, phba->mbox_mem_pool);
-				goto out;
+				goto reject_response;
 			}
 		}

@@ -540,11 +536,11 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,

 	login_mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
 	if (!login_mbox)
-		goto out;
+		goto reject_response;

 	save_iocb = kzalloc(sizeof(*save_iocb), GFP_KERNEL);
 	if (!save_iocb)
-		goto out;
+		goto free_mempool;

 	/* Save info from cmd IOCB to be used in rsp after all mbox completes */
 	memcpy((uint8_t *)save_iocb, (uint8_t *)cmdiocb,
@@ -657,9 +653,9 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 	return 1;
 out:
 	kfree(save_iocb);
-	if (login_mbox)
-		mempool_free(login_mbox, phba->mbox_mem_pool);
-
+free_mempool:
+	mempool_free(login_mbox, phba->mbox_mem_pool);
+reject_response:
 	stat.un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC;
 	stat.un.b.lsRjtRsnCodeExp = LSEXP_OUT_OF_RESOURCE;
 	lpfc_els_rsp_reject(vport, stat.un.lsRjtError, cmdiocb, ndlp, NULL);
--
2.43.0