linux-kernel - RE: [PATCH] scsi: storvsc_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 28 Feb 2014 02:08:26 +0000
From:	KY Srinivasan <kys@...rosoft.com>
To:	Ales Novak <alnovak@...e.cz>,
	"James E.J. Bottomley" <JBottomley@...allels.com>
CC:	"linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"jkosina@...e.cz" <jkosina@...e.cz>,
	Thomas Abraham <tabraham@...e.com>
Subject: RE: [PATCH] scsi: storvsc_device_destroy NULL pointer fix



> -----Original Message-----
> From: Ales Novak [mailto:alnovak@...e.cz]
> Sent: Thursday, February 27, 2014 2:04 AM
> To: KY Srinivasan; James E.J. Bottomley
> Cc: linux-scsi@...r.kernel.org; linux-kernel@...r.kernel.org;
> jkosina@...e.cz; Ales Novak; Thomas Abraham
> Subject: [PATCH] scsi: storvsc_device_destroy NULL pointer fix
> 
> If the initialization of storvsc fails, the storvsc_device_destroy() causes NULL
> pointer dereference.
> 
> storvsc_bus_scan()
>   scsi_scan_target()
>     __scsi_scan_target()
>       scsi_probe_and_add_lun(hostdata=NULL)
>         scsi_alloc_sdev(hostdata=NULL)
> 
> 	  sdev->hostdata = hostdata
> 
> 	  now the host allocation fails
> 
>           __scsi_remove_device(sdev)
> 
> 	  calls sdev->host->hostt->slave_destroy() ==
> 	  storvsc_device_destroy(sdev)
> 	    access of sdev->hostdata->request_mempool
> 
> Signed-off-by: Ales Novak <alnovak@...e.cz>
> Signed-off-by: Thomas Abraham <tabraham@...e.com>
> Acked-by: Jiri Kosina <jkosina@...e.cz>

Signed-off-by: K. Y. Srinivasan <kys@...rosoft.com>
> ---
>  drivers/scsi/storvsc_drv.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index
> 17d7404..9969fa1 100644
> --- a/drivers/scsi/storvsc_drv.c
> +++ b/drivers/scsi/storvsc_drv.c
> @@ -1419,6 +1419,9 @@ static void storvsc_device_destroy(struct
> scsi_device *sdevice)  {
>  	struct stor_mem_pools *memp = sdevice->hostdata;
> 
> +	if (!memp)
> +		return;
> +
>  	mempool_destroy(memp->request_mempool);
>  	kmem_cache_destroy(memp->request_pool);
>  	kfree(memp);
> --
> 1.8.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/