From patchwork Fri Jun 2 04:07:09 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Smart X-Patchwork-Id: 9761561 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B71B860363 for ; Fri, 2 Jun 2017 04:08:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A7FED28563 for ; Fri, 2 Jun 2017 04:08:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9CE3728579; Fri, 2 Jun 2017 04:08:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1D28328563 for ; Fri, 2 Jun 2017 04:08:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751229AbdFBEIT (ORCPT ); Fri, 2 Jun 2017 00:08:19 -0400 Received: from mail-qt0-f194.google.com ([209.85.216.194]:34786 "EHLO mail-qt0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751216AbdFBEIS (ORCPT ); Fri, 2 Jun 2017 00:08:18 -0400 Received: by mail-qt0-f194.google.com with SMTP id o21so107355qtb.1 for ; Thu, 01 Jun 2017 21:08:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=eWWRcShA6m591ZS6IV7cUZwP9dpnascpodhdzjK9gFk=; b=N/BcATNILA5cqxPoZFX3XKdZREtm2OgC0o5HPO2aOCJkd2gABY6w1FDxbBvC16gg1/ paD/eFxv3k9eY7uWqGa+KDPk1h4tL3oqPAMPgYkZtU0Dry0SnaGu1XU09T7ftJjEmkdC PLkeKSDa3Xjr9XuCci3G0hSyZQfHs0jPHXPN5DdH0s+BQeZK2tRASqx5L25/oT/P8nX7 pNMdS9VZxg37ihvPS4aOLGDuLUQjNHqEEt3wt8/fHKXzK1ZV64u6MQGOkKiyhAmoLgwn TZZZh+T4W9C2O1PLDZVjPM0uFC3lhbKiomNiKiJt1GlkedHeHMQWP5pksWhDUlKaT9hO lfXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=eWWRcShA6m591ZS6IV7cUZwP9dpnascpodhdzjK9gFk=; b=FtoQmBtV/gm4VIN942UzxM4ZDPeeEwV5HOn18SqqTGY/IfY4rRmIDYewjPNfZe7X/j GylSnmv7GyNKBjFpMSktb2VwrmVdAatO5AkhsTb4P9UJeZN/nlvUDero3QtSs6fpdtb9 Cq9IWWbpafDnoyAJ1J7ix1deKYCwnPO+rjHv3o5xn/25GHu+2IYzPsT2mvyOzFPVwRNp m3rNBY9tyZHax2MItEBPMgRksQoNbpb5F14xBzp4ljtPtikOvLH11TX9T7SoAQAjZR2S 8b1EJK3IO5GdRCqEOQ6zotQpYpKicOKoHW85kZn8PDF8sLSmJJ8sbUa+SKQR7YgFWJ4f vQ8g== X-Gm-Message-State: AODbwcA1En2sCtQqY9F5ydZPpRtGmMrSVq1TscK+lmySlKN4l3MOTaFr oOOYNY/3+msbtu0W X-Received: by 10.200.49.174 with SMTP id h43mr6552330qte.128.1496376486841; Thu, 01 Jun 2017 21:08:06 -0700 (PDT) Received: from localhost.localdomain ([192.19.224.250]) by smtp.gmail.com with ESMTPSA id x27sm14180802qtb.54.2017.06.01.21.08.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 01 Jun 2017 21:08:06 -0700 (PDT) From: James Smart To: linux-scsi@vger.kernel.org Cc: James Smart , Dick Kennedy , James Smart Subject: [PATCH v2 15/17] lpfc: Fix defects reported by Coverity Scan Date: Thu, 1 Jun 2017 21:07:09 -0700 Message-Id: <20170602040711.21046-16-jsmart2021@gmail.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170602040711.21046-1-jsmart2021@gmail.com> References: <20170602040711.21046-1-jsmart2021@gmail.com> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Addressed the following reported defects: ** CID 1411552: Control flow issues (MISSING_BREAK) /drivers/scsi/lpfc/lpfc_sli.c: 13259 in lpfc_sli4_nvmet_handle_rcqe() ** CID 1411553: Memory - illegal accesses (OVERRUN) /drivers/scsi/lpfc/lpfc_sli.c: 16218 in lpfc_fc_frame_check() ** CID 1411553: Memory - illegal accesses (OVERRUN) Overrunning array "lpfc_rctl_names" of 202 8-byte elements at element index 244 (byte offset 1952) using index "fc_hdr->fh_r_ctl" (which evaluates to 244). ** CID 1411554: Null pointer dereferences (REVERSE_INULL) /drivers/scsi/lpfc/lpfc_nvmet.c: 2131 in lpfc_nvmet_unsol_fcp_abort_cmp() ** CID 1411555: Memory - illegal accesses (UNINIT) /drivers/scsi/lpfc/lpfc_nvmet.c: 180 in lpfc_nvmet_ctxbuf_post() Signed-off-by: Dick Kennedy Signed-off-by: James Smart --- drivers/scsi/lpfc/lpfc_nvmet.c | 10 ++++------ drivers/scsi/lpfc/lpfc_sli.c | 24 +++++++++--------------- 2 files changed, 13 insertions(+), 21 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c index 9d8c4f07a2be..64908bef6f11 100644 --- a/drivers/scsi/lpfc/lpfc_nvmet.c +++ b/drivers/scsi/lpfc/lpfc_nvmet.c @@ -170,7 +170,6 @@ lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba, struct lpfc_nvmet_ctxbuf *ctx_buf) struct lpfc_nvmet_tgtport *tgtp; struct fc_frame_header *fc_hdr; struct rqb_dmabuf *nvmebuf; - struct lpfc_dmabuf *hbufp; uint32_t *payload; uint32_t size, oxid, sid, rc; unsigned long iflag; @@ -191,7 +190,6 @@ lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba, struct lpfc_nvmet_ctxbuf *ctx_buf) spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag); if (phba->sli4_hba.nvmet_io_wait_cnt) { - hbufp = &nvmebuf->hbuf; list_remove_head(&phba->sli4_hba.lpfc_nvmet_io_wait_list, nvmebuf, struct rqb_dmabuf, hbuf.list); @@ -2165,10 +2163,6 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, status = bf_get(lpfc_wcqe_c_status, wcqe); result = wcqe->parameter; - tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private; - if (ctxp->flag & LPFC_NVMET_ABORT_OP) - atomic_inc(&tgtp->xmt_fcp_abort_cmpl); - if (!ctxp) { /* if context is clear, related io alrady complete */ lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS, @@ -2178,6 +2172,10 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe, return; } + tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private; + if (ctxp->flag & LPFC_NVMET_ABORT_OP) + atomic_inc(&tgtp->xmt_fcp_abort_cmpl); + /* Sanity check */ if (ctxp->state != LPFC_NVMET_STE_ABORT) { lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS, diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index fb4c708ae747..f60c9e3e37d7 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -13267,6 +13267,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq, case FC_STATUS_RQ_BUF_LEN_EXCEEDED: lpfc_printf_log(phba, KERN_ERR, LOG_SLI, "6126 Receive Frame Truncated!!\n"); + /* Drop thru */ case FC_STATUS_RQ_SUCCESS: lpfc_sli4_rq_release(hrq, drq); spin_lock_irqsave(&phba->hbalock, iflags); @@ -16137,9 +16138,6 @@ lpfc_sli4_post_scsi_sgl_block(struct lpfc_hba *phba, return rc; } -static char *lpfc_rctl_names[] = FC_RCTL_NAMES_INIT; -static char *lpfc_type_names[] = FC_TYPE_NAMES_INIT; - /** * lpfc_fc_frame_check - Check that this frame is a valid frame to handle * @phba: pointer to lpfc_hba struct that the frame was received on @@ -16214,22 +16212,18 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr) } lpfc_printf_log(phba, KERN_INFO, LOG_ELS, - "2538 Received frame rctl:%s (x%x), type:%s (x%x), " + "2538 Received frame rctl:x%x, type:x%x, " "frame Data:%08x %08x %08x %08x %08x %08x %08x\n", - (fc_hdr->fh_r_ctl == FC_RCTL_MDS_DIAGS) ? "MDS Diags" : - lpfc_rctl_names[fc_hdr->fh_r_ctl], fc_hdr->fh_r_ctl, - (fc_hdr->fh_type == FC_TYPE_VENDOR_UNIQUE) ? - "Vendor Unique" : lpfc_type_names[fc_hdr->fh_type], - fc_hdr->fh_type, be32_to_cpu(header[0]), - be32_to_cpu(header[1]), be32_to_cpu(header[2]), - be32_to_cpu(header[3]), be32_to_cpu(header[4]), - be32_to_cpu(header[5]), be32_to_cpu(header[6])); + fc_hdr->fh_r_ctl, fc_hdr->fh_type, + be32_to_cpu(header[0]), be32_to_cpu(header[1]), + be32_to_cpu(header[2]), be32_to_cpu(header[3]), + be32_to_cpu(header[4]), be32_to_cpu(header[5]), + be32_to_cpu(header[6])); return 0; drop: lpfc_printf_log(phba, KERN_WARNING, LOG_ELS, - "2539 Dropped frame rctl:%s type:%s\n", - lpfc_rctl_names[fc_hdr->fh_r_ctl], - lpfc_type_names[fc_hdr->fh_type]); + "2539 Dropped frame rctl:x%x type:x%x\n", + fc_hdr->fh_r_ctl, fc_hdr->fh_type); return 1; }