| Message ID | 20250131195438.44964-1-jiashengjiangcool@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | scsi: qedf: Use kzalloc() and add check for bdt_info | expand |
On 1/31/25 11:54 AM, Jiasheng Jiang wrote: > - cmgr->io_bdt_pool = kmalloc_array(num_ios, sizeof(struct io_bdt *), > - GFP_KERNEL); > + cmgr->io_bdt_pool = kzalloc(num_ios * sizeof(struct io_bdt *), GFP_KERNEL); Please do not reintroduce the possibility of multiplication overflow. What is wrong with adding __GFP_ZERO to the second kmalloc_array() argument or with using kcalloc()? From include/linux/slab.h: #define kcalloc(n, size, flags) kmalloc_array(n, size, (flags) | __GFP_ZERO) Thanks, Bart.
diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c index fcfc3bed02c6..a5970fee6851 100644 --- a/drivers/scsi/qedf/qedf_io.c +++ b/drivers/scsi/qedf/qedf_io.c @@ -125,7 +125,7 @@ void qedf_cmd_mgr_free(struct qedf_cmd_mgr *cmgr) bd_tbl_sz = QEDF_MAX_BDS_PER_CMD * sizeof(struct scsi_sge); for (i = 0; i < num_ios; i++) { bdt_info = cmgr->io_bdt_pool[i]; - if (bdt_info->bd_tbl) { + if (bdt_info && bdt_info->bd_tbl) { dma_free_coherent(&qedf->pdev->dev, bd_tbl_sz, bdt_info->bd_tbl, bdt_info->bd_tbl_dma); bdt_info->bd_tbl = NULL; @@ -254,8 +254,7 @@ struct qedf_cmd_mgr *qedf_cmd_mgr_alloc(struct qedf_ctx *qedf) } /* Allocate pool of io_bdts - one for each qedf_ioreq */ - cmgr->io_bdt_pool = kmalloc_array(num_ios, sizeof(struct io_bdt *), - GFP_KERNEL); + cmgr->io_bdt_pool = kzalloc(num_ios * sizeof(struct io_bdt *), GFP_KERNEL); if (!cmgr->io_bdt_pool) { QEDF_WARN(&(qedf->dbg_ctx), "Failed to alloc io_bdt_pool.\n");
Replace kmalloc_array() with kzalloc() to avoid old (dirty) data being used/freed. Moreover, add a check for "bdt_info". Otherwise, if one of the allocations for cmgr->io_bdt_pool[i] fails, "bdt_info->bd_tbl" will cause a NULL pointer dereference. Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com> --- drivers/scsi/qedf/qedf_io.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)