From patchwork Fri Aug 21 04:29:22 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?RMSBdmlzIE1vc8SBbnM=?= X-Patchwork-Id: 7047871 Return-Path: X-Original-To: patchwork-linux-scsi@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id D20DE9F344 for ; Fri, 21 Aug 2015 04:29:54 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id AC05120632 for ; Fri, 21 Aug 2015 04:29:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D13462045A for ; Fri, 21 Aug 2015 04:29:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752044AbbHUE3v (ORCPT ); Fri, 21 Aug 2015 00:29:51 -0400 Received: from mail-wi0-f182.google.com ([209.85.212.182]:37869 "EHLO mail-wi0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751749AbbHUE3v (ORCPT ); Fri, 21 Aug 2015 00:29:51 -0400 Received: by widdq5 with SMTP id dq5so5880008wid.0 for ; Thu, 20 Aug 2015 21:29:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:mime-version:content-type :content-transfer-encoding; bh=BpSB0YIFPRuc2PJoQQfJWZOrOEofMbSZezL/iBiaBcI=; b=sOiuhIB1KEjqo+23H5mM3WcAIzQPNqj0eOUyX0O1CnuKqwJRL4M9v4RBUL4NtPLImX DvjT7t3Q13tyR0v+xeiRqJ5fvyIau6tbdLh+vOsKZgrOvzqgfV00fSn2f2PPYFjaqwPj 8y3Dl87c9w3Skb/simiXQ37I10hNgfvEfWpZEOiFHVjSbDTVmSzY3sA4HM3I4HAIk+4Q K9fy7LvtaIYeLafgBJ18FWJ9Euv1Av644E1CCaeGFGidq8YO9XMt5y35lufid7muHqDA IhpAcklwm2XMqnwANFogPEEWYVcyG2ktVAWsv5GLvqhCbrcXiTxS5E96UFJx+flq6tii rYsA== X-Received: by 10.194.171.200 with SMTP id aw8mr11706133wjc.62.1440131389766; Thu, 20 Aug 2015 21:29:49 -0700 (PDT) Received: from TebraArch.localdomain ([212.93.114.128]) by smtp.gmail.com with ESMTPSA id i1sm8214019wjq.42.2015.08.20.21.29.48 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 20 Aug 2015 21:29:49 -0700 (PDT) From: =?UTF-8?q?D=C4=81vis=20Mos=C4=81ns?= To: "James E.J. Bottomley" , linux-scsi@vger.kernel.org Cc: =?UTF-8?q?D=C4=81vis=20Mos=C4=81ns?= Subject: [PATCH] SCSI: mvsas: Fix NULL pointer dereference in mvs_slot_task_free Date: Fri, 21 Aug 2015 07:29:22 +0300 Message-Id: <1440131362-18605-1-git-send-email-davispuh@gmail.com> X-Mailer: git-send-email 2.5.0 MIME-Version: 1.0 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When pci_pool_alloc fails in mvs_task_prep then task->lldd_task stays NULL but it's later used in mvs_abort_task as slot which is passed to mvs_slot_task_free causing NULL pointer dereference. Just return from mvs_slot_task_free when passed with NULL slot. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=101891 Signed-off-by: D?vis Mos?ns Reviewed-by: Tomas Henzl Reviewed-by: Johannes Thumshirn --- drivers/scsi/mvsas/mv_sas.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c index 454536c..9c78074 100644 --- a/drivers/scsi/mvsas/mv_sas.c +++ b/drivers/scsi/mvsas/mv_sas.c @@ -887,6 +887,8 @@ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc) static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, struct mvs_slot_info *slot, u32 slot_idx) { + if (!slot) + return; if (!slot->task) return; if (!sas_protocol_ata(task->task_proto))