scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()

[ Upstream commit 8b1e9ceb2baacac1f9c26ddebb9963172eddb94d ]

Port is allocated by sas_port_alloc_num() and rphy is allocated by either
sas_end_device_alloc() or sas_expander_alloc(), all of which may return
NULL. So we need to check the rphy to avoid possible NULL pointer access.

If sas_rphy_add() returned with failure, rphy is set to NULL. We would
access the rphy in the following lines which would also result NULL pointer
access.

Fixes: 3ba756e7a02d ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()")
Signed-off-by: Wenchao Hao <haowenchao2@huawei.com>
Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index e5ecd6ada6cdd851e833fce012d1e6f987bc3c3d..e8a4750f6ec473bd6e41385fa2c920179e0c4ba5 100644 (file)
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -785,7 +785,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
                goto out_fail;
        }
        port = sas_port_alloc_num(sas_node->parent_dev);
-       if ((sas_port_add(port))) {
+       if (!port || (sas_port_add(port))) {
                ioc_err(ioc, "failure at %s:%d/%s()!\n",
                        __FILE__, __LINE__, __func__);
                goto out_fail;
@@ -824,6 +824,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
                            mpt3sas_port->remote_identify.sas_address;
        }
 
+       if (!rphy) {
+               ioc_err(ioc, "failure at %s:%d/%s()!\n",
+                       __FILE__, __LINE__, __func__);
+               goto out_delete_port;
+       }
+
        rphy->identify = mpt3sas_port->remote_identify;
 
        if ((sas_rphy_add(rphy))) {
@@ -831,6 +837,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
                        __FILE__, __LINE__, __func__);
                sas_rphy_free(rphy);
                rphy = NULL;
+               goto out_delete_port;
        }
 
        if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) {
@@ -857,7 +864,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
                    rphy_to_expander_device(rphy), hba_port->port_id);
        return mpt3sas_port;
 
- out_fail:
+out_delete_port:
+       sas_port_delete(port);
+
+out_fail:
        list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,
            port_siblings)
                list_del(&mpt3sas_phy->port_siblings);