Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1374324 > unrolled thread

[PATCH] mpt3sas: fix possible NULL dereference

Back to article view | Back to linux.kernel

Contents

  [PATCH] mpt3sas: fix possible NULL dereference Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2016-04-08 17:50 +0200
    Re: [PATCH] mpt3sas: fix possible NULL dereference "Martin K. Petersen" <martin.petersen@oracle.com> - 2016-04-15 04:50 +0200
      RE: [PATCH] mpt3sas: fix possible NULL dereference Sathya Prakash Veerichetty <sathya.prakash@broadcom.com> - 2016-04-15 19:40 +0200

#1374324 — [PATCH] mpt3sas: fix possible NULL dereference

We are dereferencing ioc->sense_dma_pool in pci_pool_free() and after
that we are checking if it is NULL, before calling pci_pool_destroy().
Lets check if it is NULL before calling both pci_pool_free() and
pci_pool_destroy().

Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 8c44b9c..778c2ec 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -3087,9 +3087,11 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
 	}
 
 	if (ioc->sense) {
-		pci_pool_free(ioc->sense_dma_pool, ioc->sense, ioc->sense_dma);
-		if (ioc->sense_dma_pool)
+		if (ioc->sense_dma_pool) {
+			pci_pool_free(ioc->sense_dma_pool, ioc->sense,
+				      ioc->sense_dma);
 			pci_pool_destroy(ioc->sense_dma_pool);
+		}
 		dexitprintk(ioc, pr_info(MPT3SAS_FMT
 			"sense_pool(0x%p): free\n",
 			ioc->name, ioc->sense));
-- 
1.9.1

[toc] | [next] | [standalone]

#1379438

>>>>> "Sudip" == Sudip Mukherjee <sudipm.mukherjee@gmail.com> writes:

Sudip> We are dereferencing ioc->sense_dma_pool in pci_pool_free() and
Sudip> after that we are checking if it is NULL, before calling
Sudip> pci_pool_destroy().  Lets check if it is NULL before calling both
Sudip> pci_pool_free() and pci_pool_destroy().

Broadcom folks, please review.

-- 
Martin K. Petersen	Oracle Linux Engineering

[toc] | [prev] | [next] | [standalone]

#1380057

We need to do some more changes in this.  The concept is first pool alloc
and then memory alloc in the pool, so the memory has to be freed if the
memory is allocated in the pool and irrespective of memory allocated or
not the pool has to be destroyed if it is created.  We will work
internally and provide a complete patch.

Thanks
Sathya

-----Original Message-----
From: Martin K. Petersen [mailto:martin.petersen@oracle.com]
Sent: Thursday, April 14, 2016 8:44 PM
To: Sudip Mukherjee
Cc: Sathya Prakash; Chaitra P B; Suganath Prabu Subramani; James E.J.
Bottomley; Martin K. Petersen; linux-kernel@vger.kernel.org;
MPT-FusionLinux.pdl@broadcom.com; linux-scsi@vger.kernel.org
Subject: Re: [PATCH] mpt3sas: fix possible NULL dereference

>>>>> "Sudip" == Sudip Mukherjee <sudipm.mukherjee@gmail.com> writes:

Sudip> We are dereferencing ioc->sense_dma_pool in pci_pool_free() and
Sudip> after that we are checking if it is NULL, before calling
Sudip> pci_pool_destroy().  Lets check if it is NULL before calling both
Sudip> pci_pool_free() and pci_pool_destroy().

Broadcom folks, please review.

-- 
Martin K. Petersen	Oracle Linux Engineering

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web