From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Johannes Thumshirn , Hannes Reinecke , Christoph Hellwig , Doug Gilbert , "Martin K . Petersen" , Sasha Levin Subject: [PATCH AUTOSEL for 3.18 015/102] scsi: sg: don't return bogus Sg_requests Date: Mon, 19 Mar 2018 16:11:46 +0000 Message-ID: <20180319161117.17833-15-alexander.levin@microsoft.com> References: <20180319161117.17833-1-alexander.levin@microsoft.com> In-Reply-To: <20180319161117.17833-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: From: Johannes Thumshirn [ Upstream commit 48ae8484e9fc324b4968d33c585e54bc98e44d61 ] If the list search in sg_get_rq_mark() fails to find a valid request, we return a bogus element. This then can later lead to a GPF in sg_remove_scat(). So don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case the list search doesn't find a valid request. Signed-off-by: Johannes Thumshirn Reported-by: Andrey Konovalov Cc: Hannes Reinecke Cc: Christoph Hellwig Cc: Doug Gilbert Reviewed-by: Hannes Reinecke Acked-by: Doug Gilbert Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/sg.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 783040af3ead..ddce52b3a87d 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -2118,11 +2118,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id) if ((1 =3D=3D resp->done) && (!resp->sg_io_owned) && ((-1 =3D=3D pack_id) || (resp->header.pack_id =3D=3D pack_id))) { resp->done =3D 2; /* guard against other readers */ - break; + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + return resp; } } write_unlock_irqrestore(&sfp->rq_list_lock, iflags); - return resp; + return NULL; } =20 /* always adds to end of list */ --=20 2.14.1