[PATCH] scsi: Fix NULL pointer dereference in scsi_setup_scsi_cmnd()

[PATCH] scsi: Fix NULL pointer dereference in scsi_setup_scsi_cmnd()

[Khemissi Mohammed el Amine]

A NULL pointer dereference can occur in scsi_setup_scsi_cmnd() when handling
BSG ioctls with zero-length requests. The function calls scsi_command_size()
before cmd->cmnd is initialized, leading to a kernel oops when the pointer
is dereferenced.

The crash occurs in the following sequence:
1. BSG ioctl issued with sg_io_v4.request = NULL, request_len = 0
2. scsi_setup_scsi_cmnd() invoked via scsi_queue_rq()
3. If scsi_req(req)->cmd_len == 0, code calls scsi_command_size(cmd->cmnd)
4. cmd->cmnd has not been set yet (still NULL or uninitialized)
5. scsi_command_size() dereferences the NULL pointer without checking
6. Kernel NULL pointer dereference oops

This issue affects Linux 5.10 LTS . Local users with access to
/dev/bsg/* device nodes can trigger this crash.

Fix this by:
1. Adding a NULL check in scsi_command_size() to handle NULL input gracefully
2. Adding a NULL check in scsi_setup_scsi_cmnd() before calling
   scsi_command_size()

Signed-off-by: Khemissi Mohammed el Amine <aminekhemissi61@gmail.com>
---
 drivers/scsi/scsi_lib.c    | 6 ++++++
 include/scsi/scsi_common.h | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 03c6d0620..4e86bfd3e 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1174,6 +1174,12 @@ static blk_status_t scsi_setup_scsi_cmnd(struct scsi_device *sdev,
 {
 	struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(req);
 
+	/* Check for NULL command pointer */
+	if (!cmd->cmnd) {
+		scsi_req(req)->result = DID_NO_CONNECT << 16;
+		return BLK_STS_IOERR;
+	}
+
 	/*
 	 * Passthrough requests may transfer data, in which case they must
 	 * a bio attached to them.  Or they might contain a SCSI command
diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h
index 5b567b43e..1d9dcadb3 100644
--- a/include/scsi/scsi_common.h
+++ b/include/scsi/scsi_common.h
@@ -21,6 +21,8 @@ extern const unsigned char scsi_command_size_tbl[8];
 static inline unsigned
 scsi_command_size(const unsigned char *cmnd)
 {
+	if (!cmnd)
+		return 0;
 	return (cmnd[0] == VARIABLE_LENGTH_CMD) ?
 		scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]);
 }
-- 
2.51.0

Re: [PATCH] scsi: Fix NULL pointer dereference in scsi_setup_scsi_cmnd()

[Greg KH]

On Mon, Feb 23, 2026 at 03:14:03PM -0800, Khemissi Mohammed el Amine wrote:
> A NULL pointer dereference can occur in scsi_setup_scsi_cmnd() when handling
> BSG ioctls with zero-length requests. The function calls scsi_command_size()
> before cmd->cmnd is initialized, leading to a kernel oops when the pointer
> is dereferenced.
> 
> The crash occurs in the following sequence:
> 1. BSG ioctl issued with sg_io_v4.request = NULL, request_len = 0
> 2. scsi_setup_scsi_cmnd() invoked via scsi_queue_rq()
> 3. If scsi_req(req)->cmd_len == 0, code calls scsi_command_size(cmd->cmnd)
> 4. cmd->cmnd has not been set yet (still NULL or uninitialized)
> 5. scsi_command_size() dereferences the NULL pointer without checking
> 6. Kernel NULL pointer dereference oops
> 
> This issue affects Linux 5.10 LTS . Local users with access to
> /dev/bsg/* device nodes can trigger this crash.
> 
> Fix this by:
> 1. Adding a NULL check in scsi_command_size() to handle NULL input gracefully
> 2. Adding a NULL check in scsi_setup_scsi_cmnd() before calling
>    scsi_command_size()
> 
> Signed-off-by: Khemissi Mohammed el Amine <aminekhemissi61@gmail.com>
> ---
>  drivers/scsi/scsi_lib.c    | 6 ++++++
>  include/scsi/scsi_common.h | 2 ++
>  2 files changed, 8 insertions(+)


<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>