From: garsilva@embeddedor.com (Gustavo A. R. Silva)
Subject: [PATCH] nvme: host: core: fix NULL pointer dereference in nvme_pr_command
Date: Mon, 13 Nov 2017 13:36:50 -0600 [thread overview]
Message-ID: <20171113193650.GA2832@embeddedor.com> (raw)
_head_ pointer is being dereferenced when it is NULL.
Fix this by moving the code that dereferences such pointer after it has
been properly initialized in function nvme_get_ns_from_disk.
Addresses-Coverity-ID: 1461344
Fixes: 32acab3181c7 ("nvme: implement multipath access to nvme subsystems")
Signed-off-by: Gustavo A. R. Silva <garsilva at embeddedor.com>
---
drivers/nvme/host/core.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 25da74d..9b9c324 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1452,16 +1452,16 @@ static int nvme_pr_command(struct block_device *bdev, u32 cdw10,
put_unaligned_le64(key, &data[0]);
put_unaligned_le64(sa_key, &data[8]);
- memset(&c, 0, sizeof(c));
- c.common.opcode = op;
- c.common.nsid = cpu_to_le32(head->ns_id);
- c.common.cdw10[0] = cpu_to_le32(cdw10);
-
ns = nvme_get_ns_from_disk(bdev->bd_disk, &head, &srcu_idx);
- if (unlikely(!ns))
+ if (unlikely(!ns)) {
ret = -EWOULDBLOCK;
- else
+ } else {
+ memset(&c, 0, sizeof(c));
+ c.common.opcode = op;
+ c.common.nsid = cpu_to_le32(head->ns_id);
+ c.common.cdw10[0] = cpu_to_le32(cdw10);
ret = nvme_submit_sync_cmd(ns->queue, &c, data, 16);
+ }
nvme_put_ns_from_disk(head, srcu_idx);
return ret;
}
--
2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
To: Keith Busch <keith.busch@intel.com>, Jens Axboe <axboe@fb.com>,
Christoph Hellwig <hch@lst.de>, Sagi Grimberg <sagi@grimberg.me>
Cc: linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org,
"Gustavo A. R. Silva" <garsilva@embeddedor.com>
Subject: [PATCH] nvme: host: core: fix NULL pointer dereference in nvme_pr_command
Date: Mon, 13 Nov 2017 13:36:50 -0600 [thread overview]
Message-ID: <20171113193650.GA2832@embeddedor.com> (raw)
_head_ pointer is being dereferenced when it is NULL.
Fix this by moving the code that dereferences such pointer after it has
been properly initialized in function nvme_get_ns_from_disk.
Addresses-Coverity-ID: 1461344
Fixes: 32acab3181c7 ("nvme: implement multipath access to nvme subsystems")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/nvme/host/core.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 25da74d..9b9c324 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1452,16 +1452,16 @@ static int nvme_pr_command(struct block_device *bdev, u32 cdw10,
put_unaligned_le64(key, &data[0]);
put_unaligned_le64(sa_key, &data[8]);
- memset(&c, 0, sizeof(c));
- c.common.opcode = op;
- c.common.nsid = cpu_to_le32(head->ns_id);
- c.common.cdw10[0] = cpu_to_le32(cdw10);
-
ns = nvme_get_ns_from_disk(bdev->bd_disk, &head, &srcu_idx);
- if (unlikely(!ns))
+ if (unlikely(!ns)) {
ret = -EWOULDBLOCK;
- else
+ } else {
+ memset(&c, 0, sizeof(c));
+ c.common.opcode = op;
+ c.common.nsid = cpu_to_le32(head->ns_id);
+ c.common.cdw10[0] = cpu_to_le32(cdw10);
ret = nvme_submit_sync_cmd(ns->queue, &c, data, 16);
+ }
nvme_put_ns_from_disk(head, srcu_idx);
return ret;
}
--
2.7.4
next reply other threads:[~2017-11-13 19:36 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-13 19:36 Gustavo A. R. Silva [this message]
2017-11-13 19:36 ` [PATCH] nvme: host: core: fix NULL pointer dereference in nvme_pr_command Gustavo A. R. Silva
2017-11-13 19:38 ` Sagi Grimberg
2017-11-13 19:38 ` Sagi Grimberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171113193650.GA2832@embeddedor.com \
--to=garsilva@embeddedor.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.