From 0ed0283f0297d0bb6b34a831a4989dd58f4c8368 Mon Sep 17 00:00:00 2001 From: Dinghao Liu Date: Wed, 3 Mar 2021 15:34:08 +0800 Subject: [PATCH] sata_dwc_460ex: Fix missing check in sata_dwc_isr The return value of ata_qc_from_tag() is checked in the whole kernel except for two calls in sata_dwc_isr(), which may lead to null-pointer-dereference. Add return value checks to avoid such case. Signed-off-by: Dinghao Liu Signed-off-by: Jens Axboe --- drivers/ata/sata_dwc_460ex.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c index 9dcef6ac643b9..f0ef844428bb4 100644 --- a/drivers/ata/sata_dwc_460ex.c +++ b/drivers/ata/sata_dwc_460ex.c @@ -543,6 +543,11 @@ static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) hsdev->sactive_issued |= qcmd_tag_to_mask(tag); qc = ata_qc_from_tag(ap, tag); + if (unlikely(!qc)) { + dev_err(ap->dev, "failed to get qc"); + handled = 1; + goto DONE; + } /* * Start FP DMA for NCQ command. At this point the tag is the * active tag. It is the tag that matches the command about to @@ -658,6 +663,11 @@ DRVSTILLBUSY: tag_mask &= (~0x00000001); qc = ata_qc_from_tag(ap, tag); + if (unlikely(!qc)) { + dev_err(ap->dev, "failed to get qc"); + handled = 1; + goto DONE; + } /* To be picked up by completion functions */ qc->ap->link.active_tag = tag; -- 2.30.2