From mboxrd@z Thu Jan 1 00:00:00 1970
From: bugzilla-daemon@bugzilla.kernel.org
Subject: [Bug 49241] New: Unsafe dereference of pointer after allocing memory
Date: Mon, 22 Oct 2012 09:35:47 +0000 (UTC)
Message-ID:
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Return-path:
Received: from mail.kernel.org ([198.145.19.201]:52257 "EHLO mail.kernel.org"
rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
id S1751125Ab2JVJfv (ORCPT );
Mon, 22 Oct 2012 05:35:51 -0400
Received: from mail.kernel.org (localhost [127.0.0.1])
by mail.kernel.org (Postfix) with ESMTP id 4167520273
for ; Mon, 22 Oct 2012 09:35:49 +0000 (UTC)
Received: from bugzilla.kernel.org (bugzilla.kernel.org [198.145.19.217])
by mail.kernel.org (Postfix) with ESMTP id 5BCB52025E
for ; Mon, 22 Oct 2012 09:35:48 +0000 (UTC)
Sender: linux-scsi-owner@vger.kernel.org
List-Id: linux-scsi@vger.kernel.org
To: linux-scsi@vger.kernel.org
https://bugzilla.kernel.org/show_bug.cgi?id=49241
Summary: Unsafe dereference of pointer after allocing memory
Product: SCSI Drivers
Version: 2.5
Kernel Version: 3.0.47
Platform: All
OS/Version: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: Other
AssignedTo: scsi_drivers-other@kernel-bugs.osdl.org
ReportedBy: yangyeping_666@hotmail.com
CC: linux-scsi@vger.kernel.org
Regression: No
Vulnerability kind: Null-pointer dereference
The file path containing this vulnerability: drivers/scsi/mac_scsi.c
Line number: 290
Severity: medium
Code fragment (from line 270 to line 290):
instance = scsi_register (tpnt, sizeof(struct NCR5380_hostdata));
#if NDEBUG
default_instance = instance;
#endif
if (macintosh_config->ident == MAC_MODEL_IIFX) {
mac_scsi_regp = via1+0x8000;
mac_scsi_drq = via1+0xE000;
mac_scsi_nodrq = via1+0xC000;
/* The IIFX should be able to do true DMA, but pseudo-dma doesn't work
*/
flags = FLAG_NO_PSEUDO_DMA;
} else {
mac_scsi_regp = via1+0x10000;
mac_scsi_drq = via1+0x6000;
mac_scsi_nodrq = via1+0x12000;
}
if (! setup_use_pdma)
flags = FLAG_NO_PSEUDO_DMA;
instance->io_port = (unsigned long) mac_scsi_regp;
Description: The variable "instance" is defined at line 270 via function
"scsi_register" but is not sanity-checked.Then it is dereferenced at line 290.
--
Configure bugmail: https://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
You are watching the assignee of the bug.