linux-kernel - Re: [PATCH] SCSI: mvsas: Fix NULL pointer dereference in mvs_slot_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 21 Oct 2015 16:18:35 +0300
From:	Dāvis Mosāns <davispuh@...il.com>
To:	Johannes Thumshirn <jthumshirn@...e.de>
Cc:	"James E.J. Bottomley" <JBottomley@...n.com>,
	linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] SCSI: mvsas: Fix NULL pointer dereference in mvs_slot_task_free

2015-10-21 10:33 GMT+03:00 Johannes Thumshirn <jthumshirn@...e.de>:
> On Tue, 2015-10-20 at 20:41 +0300, Dāvis Mosāns wrote:
>> 2015-08-21 7:29 GMT+03:00 Dāvis Mosāns <davispuh@...il.com>:
>> > When pci_pool_alloc fails in mvs_task_prep then task->lldd_task
>> > stays
>> > NULL but it's later used in mvs_abort_task as slot which is passed
>> > to mvs_slot_task_free causing NULL pointer dereference.
>> >
>> > Just return from mvs_slot_task_free when passed with NULL slot.
>> >
>> > Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=101891
>> > Signed-off-by: Dāvis Mosāns <davispuh@...il.com>
>> > ---
>> >  drivers/scsi/mvsas/mv_sas.c | 2 ++
>> >  1 file changed, 2 insertions(+)
>> >
>> > diff --git a/drivers/scsi/mvsas/mv_sas.c
>> > b/drivers/scsi/mvsas/mv_sas.c
>> > index 454536c..9c78074 100644
>> > --- a/drivers/scsi/mvsas/mv_sas.c
>> > +++ b/drivers/scsi/mvsas/mv_sas.c
>> > @@ -887,6 +887,8 @@ static void mvs_slot_free(struct mvs_info *mvi,
>> > u32 rx_desc)
>> >  static void mvs_slot_task_free(struct mvs_info *mvi, struct
>> > sas_task *task,
>> >                           struct mvs_slot_info *slot, u32 slot_idx)
>> >  {
>> > +       if (!slot)
>> > +               return;
>> >         if (!slot->task)
>> >                 return;
>> >         if (!sas_protocol_ata(task->task_proto))
>> > --
>> > 2.5.0
>> >
>>
>> Can this get merged?
>> So far since august it have saved me from several kernel crashes.
>
> If it saved you from several crashes, it probably should be tagged for
> stable, shouldn't it?
>
> Reviewed-by: Johannes Thumshirn <jthumshirn@...e.de>
>
>

I don't really know how that works... this is my first patch so I'm
not really concerned about in which version it gets in as long as it does.
I've been compiling kernel with this patch for these months so for me it
doesn't really make any difference.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/