lpfc: Fix possible NULL pointer dereference

Orabug: 25486030

Check for the existence of piocb->vport before accessing it.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Acked-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 22466da5b4b7a82d3e5a9c21c752cae91a21dc91)
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index b5cdbc6a3e3ee96f98517d5710108cb9f8820566..529c46f05c6ff58e9d00eaf9e52b8cebf63b8e79 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -1311,21 +1311,19 @@ static int
 lpfc_sli_ringtxcmpl_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                        struct lpfc_iocbq *piocb)
 {
+
+       BUG_ON(!piocb || !piocb->vport);
+
        list_add_tail(&piocb->list, &pring->txcmplq);
        piocb->iocb_flag |= LPFC_IO_ON_TXCMPLQ;
 
        if ((unlikely(pring->ringno == LPFC_ELS_RING)) &&
           (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) &&
           (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN) &&
-        (!(piocb->vport->load_flag & FC_UNLOADING))) {
-               if (!piocb->vport)
-                       BUG();
-               else
-                       mod_timer(&piocb->vport->els_tmofunc,
-                               jiffies +
-                               msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
-       }
-
+           (!(piocb->vport->load_flag & FC_UNLOADING)))
+               mod_timer(&piocb->vport->els_tmofunc,
+                         jiffies +
+                         msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
 
        return 0;
 }