Re: [PATCH] scsi: Fix NULL pointer dereference in scsi_setup_scsi_cmnd()

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Feb 23, 2026 at 03:14:03PM -0800, Khemissi Mohammed el Amine wrote:
> A NULL pointer dereference can occur in scsi_setup_scsi_cmnd() when handling
> BSG ioctls with zero-length requests. The function calls scsi_command_size()
> before cmd->cmnd is initialized, leading to a kernel oops when the pointer
> is dereferenced.
> 
> The crash occurs in the following sequence:
> 1. BSG ioctl issued with sg_io_v4.request = NULL, request_len = 0
> 2. scsi_setup_scsi_cmnd() invoked via scsi_queue_rq()
> 3. If scsi_req(req)->cmd_len == 0, code calls scsi_command_size(cmd->cmnd)
> 4. cmd->cmnd has not been set yet (still NULL or uninitialized)
> 5. scsi_command_size() dereferences the NULL pointer without checking
> 6. Kernel NULL pointer dereference oops
> 
> This issue affects Linux 5.10 LTS . Local users with access to
> /dev/bsg/* device nodes can trigger this crash.
> 
> Fix this by:
> 1. Adding a NULL check in scsi_command_size() to handle NULL input gracefully
> 2. Adding a NULL check in scsi_setup_scsi_cmnd() before calling
>    scsi_command_size()
> 
> Signed-off-by: Khemissi Mohammed el Amine <aminekhemissi61@gmail.com>
> ---
>  drivers/scsi/scsi_lib.c    | 6 ++++++
>  include/scsi/scsi_common.h | 2 ++
>  2 files changed, 8 insertions(+)


<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>