Showing error 1799

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: drivers/infiniband/ulp/srp/ib_srp.c
Line in file: 822
Project: Linux Kernel
Project version: 2.6.28
Confirmation: Fixed by 220329916c72ee3d54ae7262b215a050f04a18fc
Tools: Smatch (1.59)
Entered: 2013-09-11 08:47:26 UTC


Source:

 792        return len;
 793}
 794
 795static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
 796{
 797        struct srp_request *req;
 798        struct scsi_cmnd *scmnd;
 799        unsigned long flags;
 800        s32 delta;
 801
 802        delta = (s32) be32_to_cpu(rsp->req_lim_delta);
 803
 804        spin_lock_irqsave(target->scsi_host->host_lock, flags);
 805
 806        target->req_lim += delta;
 807
 808        req = &target->req_ring[rsp->tag & ~SRP_TAG_TSK_MGMT];
 809
 810        if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
 811                if (be32_to_cpu(rsp->resp_data_len) < 4)
 812                        req->tsk_status = -1;
 813                else
 814                        req->tsk_status = rsp->data[3];
 815                complete(&req->done);
 816        } else {
 817                scmnd = req->scmnd;
 818                if (!scmnd)
 819                        shost_printk(KERN_ERR, target->scsi_host,
 820                                     "Null scmnd for RSP w/tag %016llx\n",
 821                                     (unsigned long long) rsp->tag);
 822                scmnd->result = rsp->status;
 823
 824                if (rsp->flags & SRP_RSP_FLAG_SNSVALID) {
 825                        memcpy(scmnd->sense_buffer, rsp->data +
 826                               be32_to_cpu(rsp->resp_data_len),
 827                               min_t(int, be32_to_cpu(rsp->sense_data_len),
 828                                     SCSI_SENSE_BUFFERSIZE));
 829                }
 830
 831                if (rsp->flags & (SRP_RSP_FLAG_DOOVER | SRP_RSP_FLAG_DOUNDER))
 832                        scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt));
Show full sources