[PATCH] scsi: fix potential NULL pointer dereference.

[PATCH] scsi: fix potential NULL pointer dereference.

[Maurizio Lombardi]

The scsi_get_command() function returns NULL if
it fails to allocate the scsi_cmnd structure.
If this happens, a NULL pointer will be dereferenced.

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
---
 drivers/scsi/scsi_error.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 78b004d..4021849 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -2289,6 +2289,9 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
 		return FAILED;
 
 	scmd = scsi_get_command(dev, GFP_KERNEL);
+	if (!scmd)
+		return FAILED;
+
 	blk_rq_init(NULL, &req);
 	scmd->request = &req;
 
-- 
Maurizio Lombardi

Re: [PATCH] scsi: fix potential NULL pointer dereference.

[Christoph Hellwig]

> diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
> index 78b004d..4021849 100644
> --- a/drivers/scsi/scsi_error.c
> +++ b/drivers/scsi/scsi_error.c
> @@ -2289,6 +2289,9 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
>  		return FAILED;
>  
>  	scmd = scsi_get_command(dev, GFP_KERNEL);
> +	if (!scmd)
> +		return FAILED;
> +

Fails to call scsi_autopm_put_host, or in Jame's latest tree that has
my changes put_device on the sdev gendev.  I sent a correct version
earlier, but there has been very little enthusiasm for it.

Re: [PATCH] scsi: fix potential NULL pointer dereference.

[Maurizio Lombardi]

On Tue, Mar 25, 2014 at 06:13:06AM -0700, Christoph Hellwig wrote:
> > diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
> > index 78b004d..4021849 100644
> > --- a/drivers/scsi/scsi_error.c
> > +++ b/drivers/scsi/scsi_error.c
> > @@ -2289,6 +2289,9 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
> >  		return FAILED;
> >  
> >  	scmd = scsi_get_command(dev, GFP_KERNEL);
> > +	if (!scmd)
> > +		return FAILED;
> > +
> 
> Fails to call scsi_autopm_put_host, or in Jame's latest tree that has
> my changes put_device on the sdev gendev.  I sent a correct version
> earlier, but there has been very little enthusiasm for it.
>

Yes you are right, it should call scsi_autopm_put_host before returning.
So if you already have a correct version for it then I drop this patch.

Maurizio.
 

Re: [PATCH] scsi: fix potential NULL pointer dereference.

[Christoph Hellwig]

On Tue, Mar 25, 2014 at 02:30:46PM +0100, Maurizio Lombardi wrote:
> Yes you are right, it should call scsi_autopm_put_host before returning.
> So if you already have a correct version for it then I drop this patch.

This was the version I sent out:

http://git.infradead.org/users/hch/scsi.git/commitdiff/245e16e9091f92919c09c8bbae1d982d0717ba22

It's not correct for Jame's current tree as we also need to unwind
getting a reference on sdev_gendev now.  As there's been pushback
against the patch I didn't resubmit it yet, but now that I got my other
changes in the area in it might be worth to try again.