Commit d3c57724 authored by Wenchao Hao's avatar Wenchao Hao Committed by Martin K. Petersen

scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()

Port is allocated by sas_port_alloc_num() and rphy is allocated by either
sas_end_device_alloc() or sas_expander_alloc(), all of which may return
NULL. So we need to check the rphy to avoid possible NULL pointer access.

If sas_rphy_add() returned with failure, rphy is set to NULL. We would
access the rphy in the following lines which would also result NULL pointer
access.

Fixes: 78316e9d ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()")
Signed-off-by: default avatarWenchao Hao <haowenchao2@huawei.com>
Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.comAcked-by: default avatarSathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 288b3271
...@@ -785,7 +785,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, ...@@ -785,7 +785,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
goto out_fail; goto out_fail;
} }
port = sas_port_alloc_num(sas_node->parent_dev); port = sas_port_alloc_num(sas_node->parent_dev);
if ((sas_port_add(port))) { if (!port || (sas_port_add(port))) {
ioc_err(ioc, "failure at %s:%d/%s()!\n", ioc_err(ioc, "failure at %s:%d/%s()!\n",
__FILE__, __LINE__, __func__); __FILE__, __LINE__, __func__);
goto out_fail; goto out_fail;
...@@ -824,6 +824,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, ...@@ -824,6 +824,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
mpt3sas_port->remote_identify.sas_address; mpt3sas_port->remote_identify.sas_address;
} }
if (!rphy) {
ioc_err(ioc, "failure at %s:%d/%s()!\n",
__FILE__, __LINE__, __func__);
goto out_delete_port;
}
rphy->identify = mpt3sas_port->remote_identify; rphy->identify = mpt3sas_port->remote_identify;
if ((sas_rphy_add(rphy))) { if ((sas_rphy_add(rphy))) {
...@@ -831,6 +837,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, ...@@ -831,6 +837,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
__FILE__, __LINE__, __func__); __FILE__, __LINE__, __func__);
sas_rphy_free(rphy); sas_rphy_free(rphy);
rphy = NULL; rphy = NULL;
goto out_delete_port;
} }
if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) {
...@@ -857,7 +864,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, ...@@ -857,7 +864,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
rphy_to_expander_device(rphy), hba_port->port_id); rphy_to_expander_device(rphy), hba_port->port_id);
return mpt3sas_port; return mpt3sas_port;
out_fail: out_delete_port:
sas_port_delete(port);
out_fail:
list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,
port_siblings) port_siblings)
list_del(&mpt3sas_phy->port_siblings); list_del(&mpt3sas_phy->port_siblings);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment