From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752545AbbK3CFB (ORCPT ); Sun, 29 Nov 2015 21:05:01 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:37930 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752230AbbK3CE6 (ORCPT ); Sun, 29 Nov 2015 21:04:58 -0500 Message-Id: <20151129214704.149939503@1wt.eu> User-Agent: quilt/0.63-1 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?ISO-8859-15?q?D=C4=81vis=20Mos=C4=81ns?= , Tomas Henzl , Johannes Thumshirn , James Bottomley , Ben Hutchings , Willy Tarreau MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <8acf8256ccc72771a80b7851061027bc@local> Subject: [PATCH 2.6.32 30/38] [PATCH 30/38] mvsas: Fix NULL pointer dereference in mvs_slot_task_free Date: Mon, 30 Nov 2015 02:04:51 +0000 Content-Transfer-Encoding: X-Mailer: Evolution 3.18.2-1 X-SA-Exim-Connect-IP: 192.168.4.247 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ commit 2280521719e81919283b82902ac24058f87dfc1b upstream. When pci_pool_alloc fails in mvs_task_prep then task->lldd_task stays NULL but it's later used in mvs_abort_task as slot which is passed to mvs_slot_task_free causing NULL pointer dereference. Just return from mvs_slot_task_free when passed with NULL slot. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=101891 Signed-off-by: Dāvis Mosāns Reviewed-by: Tomas Henzl Reviewed-by: Johannes Thumshirn Signed-off-by: James Bottomley Signed-off-by: Ben Hutchings (cherry picked from commit cc1875ecbc3c9fb2774097e03870280c91c1e0e1) Signed-off-by: Willy Tarreau --- drivers/scsi/mvsas/mv_sas.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c index 0d21386..e4c01b5 100644 --- a/drivers/scsi/mvsas/mv_sas.c +++ b/drivers/scsi/mvsas/mv_sas.c @@ -1035,6 +1035,8 @@ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc) static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, struct mvs_slot_info *slot, u32 slot_idx) { + if (!slot) + return; if (!slot->task) return; if (!sas_protocol_ata(task->task_proto)) -- 1.7.12.2.21.g234cd45.dirty