Showing error 1851

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: drivers/scsi/3w-9xxx.c
Line in file: 1848
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-11 08:47:26 UTC

Source: 

1818        full_command_packet = tw_dev->command_packet_virt[request_id];
1819        full_command_packet->header.header_desc.size_header = 128;
1820        full_command_packet->header.status_block.error = 0;
1821        full_command_packet->header.status_block.severity__reserved = 0;
1822
1823        command_packet = &full_command_packet->command.newcommand;
1824        command_packet->status = 0;
1825        command_packet->opcode__reserved = TW_OPRES_IN(0, TW_OP_EXECUTE_SCSI);
1826
1827        /* We forced 16 byte cdb use earlier */
1828        if (!cdb)
1829                memcpy(command_packet->cdb, srb->cmnd, TW_MAX_CDB_LEN);
1830        else
1831                memcpy(command_packet->cdb, cdb, TW_MAX_CDB_LEN);
1832
1833        if (srb) {
1834                command_packet->unit = srb->device->id;
1835                command_packet->request_id__lunl =
1836                        cpu_to_le16(TW_REQ_LUN_IN(srb->device->lun, request_id));
1837        } else {
1838                command_packet->request_id__lunl =
1839                        cpu_to_le16(TW_REQ_LUN_IN(0, request_id));
1840                command_packet->unit = 0;
1841        }
1842
1843        command_packet->sgl_offset = 16;
1844
1845        if (!sglistarg) {
1846                /* Map sglist from scsi layer to cmd packet */
1847
1848                if (scsi_sg_count(srb)) {
1849                        if ((scsi_sg_count(srb) == 1) &&
1850                            (scsi_bufflen(srb) < TW_MIN_SGL_LENGTH)) {
1851                                if (srb->sc_data_direction == DMA_TO_DEVICE ||
1852                                    srb->sc_data_direction == DMA_BIDIRECTIONAL)
1853                                        scsi_sg_copy_to_buffer(srb,
1854                                                               tw_dev->generic_buffer_virt[request_id],
1855                                                               TW_SECTOR_SIZE);
1856                                command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
1857                                command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
1858                        } else {
Show full sources
↑