[PATCH] scsi: efct: Fix potential use-after-free on RQ setup failure

[Guangshuo Li]

Receive queues are linked to their completion queues before all tracker
allocations succeed. On failure, the RQs are freed but CQ teardown still
walks their list nodes. Publish the RQs only after all allocations succeed.

This issue was found by our static analysis tool under development.

Fixes: e10fc2335980 ("scsi: elx: efct: Hardware queue creation and deletion")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
 drivers/scsi/elx/efct/efct_hw_queues.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/elx/efct/efct_hw_queues.c b/drivers/scsi/elx/efct/efct_hw_queues.c
index 3c27f927f96c..784eadabd3aa 100644
--- a/drivers/scsi/elx/efct/efct_hw_queues.c
+++ b/drivers/scsi/elx/efct/efct_hw_queues.c
@@ -362,15 +362,18 @@ efct_hw_new_rq_set(struct hw_cq *cqs[], struct hw_rq *rqs[],
 	}
 
 	for (i = 0; i < num_rq_pairs; i++) {
-		hw->hw_rq[rqs[i]->instance] = rqs[i];
-		INIT_LIST_HEAD(&rqs[i]->list_entry);
-		list_add_tail(&rqs[i]->list_entry, &cqs[i]->q_list);
 		size = sizeof(struct efc_hw_sequence *) * rqs[i]->entry_count;
 		rqs[i]->rq_tracker = kzalloc(size, GFP_KERNEL);
 		if (!rqs[i]->rq_tracker)
 			goto error;
 	}
 
+	for (i = 0; i < num_rq_pairs; i++) {
+		hw->hw_rq[rqs[i]->instance] = rqs[i];
+		INIT_LIST_HEAD(&rqs[i]->list_entry);
+		list_add_tail(&rqs[i]->list_entry, &cqs[i]->q_list);
+	}
+
 	return 0;
 
 error:

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4