From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 3 Aug 2021 15:56:25 +0000 (+0300)
Subject: scsi: qla2xxx: Fix use after free in debug code
X-Git-Tag: v5.15-rc1~108^2~150
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e3d2612f583ba6e234cb7fe4559132c8f28905f1;p=thirdparty%2Fkernel%2Flinux.git

scsi: qla2xxx: Fix use after free in debug code

The sp->free(sp); call frees "sp" and then the debug code dereferences
it on the next line.  Swap the order.

Link: https://lore.kernel.org/r/20210803155625.GA22735@kili
Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
---

diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 0739f8ad525a1..4b5d28d89d690 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res)
 	struct bsg_job *bsg_job = sp->u.bsg_job;
 	struct fc_bsg_reply *bsg_reply = bsg_job->reply;
 
-	sp->free(sp);
-
 	ql_dbg(ql_dbg_user, sp->vha, 0x7009,
 	    "%s: sp hdl %x, result=%x bsg ptr %p\n",
 	    __func__, sp->handle, res, bsg_job);
 
+	sp->free(sp);
+
 	bsg_reply->result = res;
 	bsg_job_done(bsg_job, bsg_reply->result,
 		       bsg_reply->reply_payload_rcv_len);