From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bart Van Assche Subject: Re: [PATCH 2.6.30.4] Fix for NULL pointer dereference by SRP initiator triggered by a SCSI reset after the SRP connection has been closed Date: Wed, 5 Aug 2009 19:48:47 +0200 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: Received: from mail-ew0-f214.google.com ([209.85.219.214]:46283 "EHLO mail-ew0-f214.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750718AbZHERss convert rfc822-to-8bit (ORCPT ); Wed, 5 Aug 2009 13:48:48 -0400 Received: by ewy10 with SMTP id 10so175715ewy.37 for ; Wed, 05 Aug 2009 10:48:48 -0700 (PDT) In-Reply-To: Sender: linux-scsi-owner@vger.kernel.org List-Id: linux-scsi@vger.kernel.org To: Roland Dreier Cc: Sean Hefty , Hal Rosenstock , OpenIB , Vladislav Bolkhovitin , linux-scsi On Wed, Aug 5, 2009 at 7:44 PM, Roland Dreier wrote: > > =A0> The NULL pointer dereference happens when srp_reset_device() cal= ls > =A0> srp_send_tsk_mgmt(target, req, SRP_TSK_LUN_RESET) with > =A0> req->scmnd->device =3D=3D NULL. When the sg_reset command issues= an > =A0> SG_SCSI_RESET ioctl, scsi_reset_provider() is invoked and alloca= tes an > =A0> scmnd structure and sets scmnd->device to NULL. It is this scmnd > =A0> structure that is passed to srp_reset_device(). What I'm not sur= e > =A0> about is whether scsi_reset_provider() should set req->scmnd->de= vice > =A0> to a non-NULL value or whether srp_send_tsk_mgmt() should be abl= e to > =A0> handle the condition req->scmnd->device =3D=3D NULL. > > Well, I don't see how the reset ioctl can do anything useful unless i= t > passes a device in with the scsi command -- otherwise for example > srp_reset_device() has no idea what LUN to try and reset. (added linux-scsi in CC) I hope one of the SCSI people can tell us why scsi_reset_provider() passes the value NULL in req->scmnd->device to -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" i= n the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html