Commit e7950423 authored by Sudip Mukherjee's avatar Sudip Mukherjee Committed by James Bottomley

lpfc: fix memory leak and NULL dereference

kmalloc() can return NULL and without checking we were dereferencing it.
Moreover if kmalloc succeeds but the function fails in other parts then
we were returning the error code but we missed freeing lcb_context.
While at it fixed one related checkpatch warning.
Signed-off-by: default avatarSudip Mukherjee <sudip@vectorindia.org>
Reviewed-by: default avatarJames Smart <james.smart@avagotech.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
parent 481ebb3d
...@@ -5173,7 +5173,6 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, ...@@ -5173,7 +5173,6 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
rjt_err = LSRJT_CMD_UNSUPPORTED; rjt_err = LSRJT_CMD_UNSUPPORTED;
goto rjt; goto rjt;
} }
lcb_context = kmalloc(sizeof(struct lpfc_lcb_context), GFP_KERNEL);
if (phba->hba_flag & HBA_FCOE_MODE) { if (phba->hba_flag & HBA_FCOE_MODE) {
rjt_err = LSRJT_CMD_UNSUPPORTED; rjt_err = LSRJT_CMD_UNSUPPORTED;
...@@ -5204,6 +5203,12 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, ...@@ -5204,6 +5203,12 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
goto rjt; goto rjt;
} }
lcb_context = kmalloc(sizeof(*lcb_context), GFP_KERNEL);
if (!lcb_context) {
rjt_err = LSRJT_UNABLE_TPC;
goto rjt;
}
state = (beacon->lcb_sub_command == LPFC_LCB_ON) ? 1 : 0; state = (beacon->lcb_sub_command == LPFC_LCB_ON) ? 1 : 0;
lcb_context->sub_command = beacon->lcb_sub_command; lcb_context->sub_command = beacon->lcb_sub_command;
lcb_context->type = beacon->lcb_type; lcb_context->type = beacon->lcb_type;
...@@ -5214,6 +5219,7 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, ...@@ -5214,6 +5219,7 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
if (lpfc_sli4_set_beacon(vport, lcb_context, state)) { if (lpfc_sli4_set_beacon(vport, lcb_context, state)) {
lpfc_printf_vlog(ndlp->vport, KERN_ERR, lpfc_printf_vlog(ndlp->vport, KERN_ERR,
LOG_ELS, "0193 failed to send mail box"); LOG_ELS, "0193 failed to send mail box");
kfree(lcb_context);
lpfc_nlp_put(ndlp); lpfc_nlp_put(ndlp);
rjt_err = LSRJT_UNABLE_TPC; rjt_err = LSRJT_UNABLE_TPC;
goto rjt; goto rjt;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment