From 93580a788261b9438fb3a9b4faf02c3149930f1f Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Sun, 5 Sep 2021 15:43:35 +0000 Subject: [PATCH] qla2x00t-32gbit: Fix use after free in debug code The sp->free(sp); call frees "sp" and then the debug code dereferences it on the next line. Swap the order. Link: https://lore.kernel.org/r/20210803155625.GA22735@kili Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els") Reviewed-by: Ewan D. Milne Reviewed-by: Himanshu Madhani Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen [ commit e3d2612f583ba6e234cb7fe4559132c8f28905f1 upstream ] git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@9538 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- qla2x00t-32gbit/qla_bsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/qla2x00t-32gbit/qla_bsg.c b/qla2x00t-32gbit/qla_bsg.c index ddcbad4aa..f6f094ac5 100644 --- a/qla2x00t-32gbit/qla_bsg.c +++ b/qla2x00t-32gbit/qla_bsg.c @@ -46,12 +46,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res) BSG_JOB_TYPE *bsg_job = sp->u.bsg_job; struct fc_bsg_reply *bsg_reply = bsg_job->reply; - sp->free(sp); - ql_dbg(ql_dbg_user, sp->vha, 0x7009, "%s: sp hdl %x, result=%x bsg ptr %p\n", __func__, sp->handle, res, bsg_job); + sp->free(sp); + bsg_reply->result = res; bsg_job_done(bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);