diff options
| author | Bradley Grove <bgrove@attotech.com> | 2013-08-29 15:55:40 -0400 |
|---|---|---|
| committer | James Bottomley <JBottomley@Parallels.com> | 2013-09-06 11:13:25 -0700 |
| commit | 64d29bd83ef36911001afc3d1f21404106739ce1 (patch) | |
| tree | 270f0e98bb68b92e1b0b6278b843808c0779f3f5 | |
| parent | c88d2dddb0b84aaa1de2985627c081c9742667ae (diff) | |
| download | op-kernel-dev-64d29bd83ef36911001afc3d1f21404106739ce1.zip op-kernel-dev-64d29bd83ef36911001afc3d1f21404106739ce1.tar.gz | |
[SCSI] esas2r: smatch - Fix dereference that occurs prior to check
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bradley Grove <bgrove@attotech.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
| -rw-r--r-- | drivers/scsi/esas2r/esas2r_flash.c | 7 | ||||
| -rw-r--r-- | drivers/scsi/esas2r/esas2r_init.c | 3 |
2 files changed, 8 insertions, 2 deletions
diff --git a/drivers/scsi/esas2r/esas2r_flash.c b/drivers/scsi/esas2r/esas2r_flash.c index 8582929..45e353f 100644 --- a/drivers/scsi/esas2r/esas2r_flash.c +++ b/drivers/scsi/esas2r/esas2r_flash.c @@ -860,8 +860,13 @@ bool esas2r_process_fs_ioctl(struct esas2r_adapter *a, return false; } + if (fsc->command >= cmdcnt) { + fs->status = ATTO_STS_INV_FUNC; + return false; + } + func = cmd_to_fls_func[fsc->command]; - if (fsc->command >= cmdcnt || func == 0xFF) { + if (func == 0xFF) { fs->status = ATTO_STS_INV_FUNC; return false; } diff --git a/drivers/scsi/esas2r/esas2r_init.c b/drivers/scsi/esas2r/esas2r_init.c index 78b18c1..9aaad0d 100644 --- a/drivers/scsi/esas2r/esas2r_init.c +++ b/drivers/scsi/esas2r/esas2r_init.c @@ -665,7 +665,7 @@ void esas2r_kill_adapter(int i) int esas2r_cleanup(struct Scsi_Host *host) { - struct esas2r_adapter *a = (struct esas2r_adapter *)host->hostdata; + struct esas2r_adapter *a; int index; if (host == NULL) { @@ -678,6 +678,7 @@ int esas2r_cleanup(struct Scsi_Host *host) } esas2r_debug("esas2r_cleanup called for host %p", host); + a = (struct esas2r_adapter *)host->hostdata; index = a->index; esas2r_kill_adapter(index); return index; |
