Commit 0ed0283f authored by Dinghao Liu's avatar Dinghao Liu Committed by Jens Axboe
Browse files

sata_dwc_460ex: Fix missing check in sata_dwc_isr 



The return value of ata_qc_from_tag() is checked in the whole
kernel except for two calls in sata_dwc_isr(), which may lead
to null-pointer-dereference. Add return value checks to avoid
such case.

Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 9a9d3abe

drivers/ata/sata_dwc_460ex.c

+10 −0
Original line number Diff line number Diff line
@@ -543,6 +543,11 @@ static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) 
		hsdev->sactive_issued |= qcmd_tag_to_mask(tag);



		qc = ata_qc_from_tag(ap, tag);

		if (unlikely(!qc)) {

			dev_err(ap->dev, "failed to get qc");

			handled = 1;

			goto DONE;

		}

		/*

		 * Start FP DMA for NCQ command.  At this point the tag is the

		 * active tag.  It is the tag that matches the command about to
@@ -658,6 +663,11 @@ static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) 


		tag_mask &= (~0x00000001);

		qc = ata_qc_from_tag(ap, tag);

		if (unlikely(!qc)) {

			dev_err(ap->dev, "failed to get qc");

			handled = 1;

			goto DONE;

		}



		/* To be picked up by completion functions */

		qc->ap->link.active_tag = tag;