+++ /dev/null
-From: Gerald Schaefer <geraldsc@de.ibm.com>
-Subject: zfcp: Don't call zfcp_fsf_req_free on NULL pointer
-References: bnc#484767,LTC#52234
-
-Symptom: Reading adapter statistics from user space on a full
- queue might lead to the attempt of freeing memory on
- a NULL pointer.
-Problem: The error path for the queue full case is wrong in the code.
-Solution: Only free the FSF request if it has been sucessfully allocated
- before
-
-Acked-by: John Jolly <jjolly@suse.de>
----
- drivers/s390/scsi/zfcp_fsf.c | 18 ++++++++++++------
- 1 file changed, 12 insertions(+), 6 deletions(-)
-
---- a/drivers/s390/scsi/zfcp_fsf.c 2009-03-16 15:34:34.000000000 +0100
-+++ b/drivers/s390/scsi/zfcp_fsf.c 2009-03-16 16:04:01.000000000 +0100
-@@ -1256,13 +1256,13 @@ int zfcp_fsf_exchange_config_data_sync(s
-
- spin_lock_bh(&adapter->req_q_lock);
- if (zfcp_fsf_req_sbal_get(adapter))
-- goto out;
-+ goto out_unlock;
-
- req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_CONFIG_DATA,
- 0, NULL);
- if (IS_ERR(req)) {
- retval = PTR_ERR(req);
-- goto out;
-+ goto out_unlock;
- }
-
- sbale = zfcp_qdio_sbale_req(req);
-@@ -1281,14 +1281,16 @@ int zfcp_fsf_exchange_config_data_sync(s
-
- zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
- retval = zfcp_fsf_req_send(req);
--out:
- spin_unlock_bh(&adapter->req_q_lock);
- if (!retval)
- wait_event(req->completion_wq,
- req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
-
- zfcp_fsf_req_free(req);
-+ return retval;
-
-+out_unlock:
-+ spin_unlock_bh(&adapter->req_q_lock);
- return retval;
- }
-
-@@ -1355,13 +1357,13 @@ int zfcp_fsf_exchange_port_data_sync(str
-
- spin_lock_bh(&adapter->req_q_lock);
- if (zfcp_fsf_req_sbal_get(adapter))
-- goto out;
-+ goto out_unlock;
-
- req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_PORT_DATA, 0,
- NULL);
- if (IS_ERR(req)) {
- retval = PTR_ERR(req);
-- goto out;
-+ goto out_unlock;
- }
-
- if (data)
-@@ -1374,14 +1376,18 @@ int zfcp_fsf_exchange_port_data_sync(str
- req->handler = zfcp_fsf_exchange_port_data_handler;
- zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
- retval = zfcp_fsf_req_send(req);
--out:
- spin_unlock_bh(&adapter->req_q_lock);
-+
- if (!retval)
- wait_event(req->completion_wq,
- req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
- zfcp_fsf_req_free(req);
-
- return retval;
-+
-+out_unlock:
-+ spin_unlock_bh(&adapter->req_q_lock);
-+ return retval;
- }
-
- static void zfcp_fsf_open_port_handler(struct zfcp_fsf_req *req)