diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-08-03 18:56:25 +0300 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2021-08-05 23:21:08 -0400 |
| commit | e3d2612f583ba6e234cb7fe4559132c8f28905f1 (patch) | |
| tree | bc122bebb32cc0985baafeafa4f520c4c530381e /drivers/scsi/qla2xxx/qla_bsg.c | |
| parent | 40fd8845c025c33629e469f1383151096a21d524 (diff) | |
scsi: qla2xxx: Fix use after free in debug code
The sp->free(sp); call frees "sp" and then the debug code dereferences
it on the next line. Swap the order.
Link: https://lore.kernel.org/r/20210803155625.GA22735@kili
Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/qla2xxx/qla_bsg.c')
| -rw-r--r-- | drivers/scsi/qla2xxx/qla_bsg.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c index 0739f8ad525a..4b5d28d89d69 100644 --- a/drivers/scsi/qla2xxx/qla_bsg.c +++ b/drivers/scsi/qla2xxx/qla_bsg.c @@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res) struct bsg_job *bsg_job = sp->u.bsg_job; struct fc_bsg_reply *bsg_reply = bsg_job->reply; - sp->free(sp); - ql_dbg(ql_dbg_user, sp->vha, 0x7009, "%s: sp hdl %x, result=%x bsg ptr %p\n", __func__, sp->handle, res, bsg_job); + sp->free(sp); + bsg_reply->result = res; bsg_job_done(bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len); |