linux-kernel - Re: [PATCH] scsi: lpfc: don't dereference dma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c7423fa3-299b-c010-bf4e-c34a11c146d3@broadcom.com>
Date:   Sat, 4 Mar 2017 09:42:45 -0800
From:   James Smart <james.smart@...adcom.com>
To:     Colin King <colin.king@...onical.com>,
        Dick Kennedy <dick.kennedy@...adcom.com>,
        "James E . J . Bottomley" <jejb@...ux.vnet.ibm.com>,
        "Martin K . Petersen" <martin.petersen@...cle.com>,
        linux-scsi@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: lpfc: don't dereference dma_buf->iocbq before null
 check

Looks good. I included it in the lpfc patch set just posted.

-- james


On 2/24/2017 6:09 AM, Colin King wrote:
> From: Colin Ian King <colin.king@...onical.com>
>
> dma_buf->iocbq is being dereferenced immediately before it is
> being null checked, so we have a potential null pointer dereference
> bug.  Fix this by only dereferencing it only once we have passed
> a null check on the pointer.
>
> Detected by CoverityScan, CID#1411652 ("Dereference before null check")
>
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>   drivers/scsi/lpfc/lpfc_mem.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
> index c61d8d6..5986c79 100644
> --- a/drivers/scsi/lpfc/lpfc_mem.c
> +++ b/drivers/scsi/lpfc/lpfc_mem.c
> @@ -646,7 +646,6 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
>   	}
>   
>   	dma_buf->iocbq = lpfc_sli_get_iocbq(phba);
> -	dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
>   	if (!dma_buf->iocbq) {
>   		kfree(dma_buf->context);
>   		pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
> @@ -658,6 +657,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
>   				"2621 Ran out of nvmet iocb/WQEs\n");
>   		return NULL;
>   	}
> +	dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
>   	nvmewqe = dma_buf->iocbq;
>   	wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
>   	/* Initialize WQE */