Commit e3d2612f authored by Dan Carpenter's avatar Dan Carpenter Committed by Martin K. Petersen

scsi: qla2xxx: Fix use after free in debug code

The sp->free(sp); call frees "sp" and then the debug code dereferences
it on the next line.  Swap the order.

Link: https://lore.kernel.org/r/20210803155625.GA22735@kili
Fixes: 84318a9f ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
Reviewed-by: default avatarEwan D. Milne <emilne@redhat.com>
Reviewed-by: default avatarHimanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 40fd8845
......@@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res)
struct bsg_job *bsg_job = sp->u.bsg_job;
struct fc_bsg_reply *bsg_reply = bsg_job->reply;
sp->free(sp);
ql_dbg(ql_dbg_user, sp->vha, 0x7009,
"%s: sp hdl %x, result=%x bsg ptr %p\n",
__func__, sp->handle, res, bsg_job);
sp->free(sp);
bsg_reply->result = res;
bsg_job_done(bsg_job, bsg_reply->result,
bsg_reply->reply_payload_rcv_len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment