diff options
| author | Dinghao Liu <dinghao.liu@zju.edu.cn> | 2021-03-03 15:34:08 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2021-03-12 07:28:29 -0700 |
| commit | 0ed0283f0297d0bb6b34a831a4989dd58f4c8368 (patch) | |
| tree | 6eced016cf081be97adced5b88ba0b4f268bfef6 /drivers/ata/sata_dwc_460ex.c | |
| parent | 9a9d3abe24bb6b820e50190147ac880fd0b168f6 (diff) | |
sata_dwc_460ex: Fix missing check in sata_dwc_isr
The return value of ata_qc_from_tag() is checked in the whole
kernel except for two calls in sata_dwc_isr(), which may lead
to null-pointer-dereference. Add return value checks to avoid
such case.
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/ata/sata_dwc_460ex.c')
| -rw-r--r-- | drivers/ata/sata_dwc_460ex.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c index 9dcef6ac643b..f0ef844428bb 100644 --- a/drivers/ata/sata_dwc_460ex.c +++ b/drivers/ata/sata_dwc_460ex.c @@ -543,6 +543,11 @@ static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) hsdev->sactive_issued |= qcmd_tag_to_mask(tag); qc = ata_qc_from_tag(ap, tag); + if (unlikely(!qc)) { + dev_err(ap->dev, "failed to get qc"); + handled = 1; + goto DONE; + } /* * Start FP DMA for NCQ command. At this point the tag is the * active tag. It is the tag that matches the command about to @@ -658,6 +663,11 @@ DRVSTILLBUSY: tag_mask &= (~0x00000001); qc = ata_qc_from_tag(ap, tag); + if (unlikely(!qc)) { + dev_err(ap->dev, "failed to get qc"); + handled = 1; + goto DONE; + } /* To be picked up by completion functions */ qc->ap->link.active_tag = tag; |