[PATCH] scsi: aic7xxx: avoid NULL deref of cur_column in ahc_print_register()

[PATCH] scsi: aic7xxx: avoid NULL deref of cur_column in ahc_print_register()

[Stepan Ionichev]

ahc_print_register() takes an optional 'cur_column' pointer that may
be NULL.  The function already guards two of its three accesses:

	if (cur_column != NULL && *cur_column >= wrap_point) {
		printk("\n");
		*cur_column = 0;
	}
	...
	if (cur_column != NULL)
		*cur_column += printed;
	return (printed);

The early-return path taken when 'table' is NULL forgot the guard:

	if (table == NULL) {
		printed += printk(" ");
		*cur_column += printed;     /* unconditional deref */
		return (printed);
	}

If a caller passes (cur_column == NULL, table == NULL) the kernel
NULL-derefs in the early-return path while otherwise doing the right
thing in the rest of the function.

smatch flags the inconsistency:

  drivers/scsi/aic7xxx/aic7xxx_core.c:7067 ahc_print_register() error:
  we previously assumed 'cur_column' could be null (see line 7060)

Mirror the existing NULL check used at the function's tail before
updating *cur_column on the early-return path.

No functional change for callers that pass a non-NULL cur_column.

Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
---
 drivers/scsi/aic7xxx/aic7xxx_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
index b9761f9f0..82eb84afb 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
@@ -7064,7 +7064,8 @@ ahc_print_register(const ahc_reg_parse_entry_t *table, u_int num_entries,
 	printed  = printk("%s[0x%x]", name, value);
 	if (table == NULL) {
 		printed += printk(" ");
-		*cur_column += printed;
+		if (cur_column != NULL)
+			*cur_column += printed;
 		return (printed);
 	}
 	printed_mask = 0;
-- 
2.43.0