lpfc: fix memory leak and NULL dereference

Orabug: 22493326

kmalloc() can return NULL and without checking we were dereferencing it.
Moreover if kmalloc succeeds but the function fails in other parts then
we were returning the error code but we missed freeing lcb_context.
While at it fixed one related checkpatch warning.

Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Reviewed-by: James Smart <james.smart@avagotech.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
(cherry picked from commit e79504236548e4c909959ba444f87a12224555ac)

Signed-off-by: Manjunath Govindashetty <manjunath.govindashetty@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 76a538b1ee2e90699a200cdda52864909d12d4e5..f89fcf80b3a0e289a71de45c96e82b9a7efd098e 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -5183,7 +5183,6 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
                rjt_err = LSRJT_CMD_UNSUPPORTED;
                goto rjt;
        }
-       lcb_context = kmalloc(sizeof(struct lpfc_lcb_context), GFP_KERNEL);
 
        if (phba->hba_flag & HBA_FCOE_MODE) {
                rjt_err = LSRJT_CMD_UNSUPPORTED;
@@ -5214,6 +5213,12 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
                goto rjt;
        }
 
+       lcb_context = kmalloc(sizeof(*lcb_context), GFP_KERNEL);
+       if (!lcb_context) {
+               rjt_err = LSRJT_UNABLE_TPC;
+               goto rjt;
+       }
+
        state = (beacon->lcb_sub_command == LPFC_LCB_ON) ? 1 : 0;
        lcb_context->sub_command = beacon->lcb_sub_command;
        lcb_context->type = beacon->lcb_type;
@@ -5224,6 +5229,7 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
        if (lpfc_sli4_set_beacon(vport, lcb_context, state)) {
                lpfc_printf_vlog(ndlp->vport, KERN_ERR,
                                 LOG_ELS, "0193 failed to send mail box");
+               kfree(lcb_context);
                lpfc_nlp_put(ndlp);
                rjt_err = LSRJT_UNABLE_TPC;
                goto rjt;