[PATCH] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port

[PATCH] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port

[Maurizio Lombardi]

The function core_scsi3_decode_spec_i_port(), in its error code path,
unconditionally calls core_scsi3_lunacl_undepend_item()
passing the dest_se_deve pointer, which may be NULL.

This can lead to a NULL pointer dereference if
dest_se_deve remains unset.

SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg
Unable to handle kernel paging request at virtual address dfff800000000012
Call trace:
  core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)
  core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]
  core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]
  target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]

Fix this by adding a NULL check before calling
core_scsi3_lunacl_undepend_item()

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
---
 drivers/target/target_core_pr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 34cf2c399b39..70905805cb17 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1842,7 +1842,9 @@ core_scsi3_decode_spec_i_port(
 		}
 
 		kmem_cache_free(t10_pr_reg_cache, dest_pr_reg);
-		core_scsi3_lunacl_undepend_item(dest_se_deve);
+
+		if (dest_se_deve)
+			core_scsi3_lunacl_undepend_item(dest_se_deve);
 
 		if (is_local)
 			continue;
-- 
2.47.1

Re: [PATCH] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port

[michael.christie]

On 6/12/25 5:15 AM, Maurizio Lombardi wrote:
> The function core_scsi3_decode_spec_i_port(), in its error code path,
> unconditionally calls core_scsi3_lunacl_undepend_item()
> passing the dest_se_deve pointer, which may be NULL.
> 
> This can lead to a NULL pointer dereference if
> dest_se_deve remains unset.
> 
> SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg
> Unable to handle kernel paging request at virtual address dfff800000000012
> Call trace:
>   core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)
>   core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]
>   core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]
>   target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]
> 
> Fix this by adding a NULL check before calling
> core_scsi3_lunacl_undepend_item()
> 
> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>


Reviewed-by: Mike Christie <michael.christie@oracle.com>

Re: [PATCH] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port

[John Meneghini]

This bug reported by one of our customers just the other day.

Maurizio turned around the fix in less than a day.

Great job Maurizio!

Reviewed-by: John Meneghini <jmeneghi@redhat.com>

On 6/12/25 6:15 AM, Maurizio Lombardi wrote:
> The function core_scsi3_decode_spec_i_port(), in its error code path,
> unconditionally calls core_scsi3_lunacl_undepend_item()
> passing the dest_se_deve pointer, which may be NULL.
> 
> This can lead to a NULL pointer dereference if
> dest_se_deve remains unset.
> 
> SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg
> Unable to handle kernel paging request at virtual address dfff800000000012
> Call trace:
>    core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)
>    core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]
>    core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]
>    target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]
> 
> Fix this by adding a NULL check before calling
> core_scsi3_lunacl_undepend_item()
> 
> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
> ---
>   drivers/target/target_core_pr.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
> index 34cf2c399b39..70905805cb17 100644
> --- a/drivers/target/target_core_pr.c
> +++ b/drivers/target/target_core_pr.c
> @@ -1842,7 +1842,9 @@ core_scsi3_decode_spec_i_port(
>   		}
>   
>   		kmem_cache_free(t10_pr_reg_cache, dest_pr_reg);
> -		core_scsi3_lunacl_undepend_item(dest_se_deve);
> +
> +		if (dest_se_deve)
> +			core_scsi3_lunacl_undepend_item(dest_se_deve);
>   
>   		if (is_local)
>   			continue;

Re: [PATCH] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port

[Martin K. Petersen]

On Thu, 12 Jun 2025 12:15:56 +0200, Maurizio Lombardi wrote:

> The function core_scsi3_decode_spec_i_port(), in its error code path,
> unconditionally calls core_scsi3_lunacl_undepend_item()
> passing the dest_se_deve pointer, which may be NULL.
> 
> This can lead to a NULL pointer dereference if
> dest_se_deve remains unset.
> 
> [...]

Applied to 6.16/scsi-fixes, thanks!

[1/1] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port
      https://git.kernel.org/mkp/scsi/c/d8ab68bdb294

-- 
Martin K. Petersen	Oracle Linux Engineering