linux-kernel - Re: [PATCH] sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() in sym

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHp75Vc=Fg165nL+SFDXXDzBvtba+C7CLK24gyz3EaAb8QdjNQ@mail.gmail.com>
Date:   Wed, 29 Aug 2018 19:56:22 +0300
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     george.kennedy@...cle.com
Cc:     matthew@....cx,
        "James E . J . Bottomley" <jejb@...ux.vnet.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        linux-scsi <linux-scsi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] sym53c8xx: fix NULL pointer dereference panic in
 sym_int_sir() in sym_hipd.c

On Wed, Aug 29, 2018 at 6:42 PM George Kennedy
<george.kennedy@...cle.com> wrote:
>
> sym_int_sir() in sym_hipd.c does not check the command pointer for NULL
> before using it in debug message prints.
>
> Suggested-by: Matthew Wilcox <matthew.wilcox@...cle.com>
> Signed-off-by: George Kennedy <george.kennedy@...cle.com>
> Reviewed-by: Mark Kanda <mark.kanda@...cle.com>

> +#define sym_printk(lvl, tp, cp, fmt, v...) do { \

Since all users are KERN_WARNING level, perhaps

sym_pr_warn(tp, ...) ... \
... \
..._printk(KERN_WARNING ...

?

> +       if (cp)                                                 \
> +               scmd_printk(lvl, cp->cmd, fmt, ##v);            \
> +       else                                                    \
> +               starget_printk(lvl, tp->starget, fmt, ##v);     \
> +} while (0)
> +
>  /*
>   *  chip exception handler for programmed interrupts.
>   */
> @@ -4415,7 +4422,7 @@ static void sym_int_sir(struct sym_hcb *np)
>          *  been selected with ATN.  We do not want to handle that.
>          */
>         case SIR_SEL_ATN_NO_MSG_OUT:
> -               scmd_printk(KERN_WARNING, cp->cmd,
> +               sym_printk(KERN_WARNING, tp, cp,
>                                 "No MSG OUT phase after selection with ATN\n");
>                 goto out_stuck;
>         /*
> @@ -4423,7 +4430,7 @@ static void sym_int_sir(struct sym_hcb *np)
>          *  having reselected the initiator.
>          */
>         case SIR_RESEL_NO_MSG_IN:
> -               scmd_printk(KERN_WARNING, cp->cmd,
> +               sym_printk(KERN_WARNING, tp, cp,
>                                 "No MSG IN phase after reselection\n");
>                 goto out_stuck;
>         /*
> @@ -4431,7 +4438,7 @@ static void sym_int_sir(struct sym_hcb *np)
>          *  an IDENTIFY.
>          */
>         case SIR_RESEL_NO_IDENTIFY:
> -               scmd_printk(KERN_WARNING, cp->cmd,
> +               sym_printk(KERN_WARNING, tp, cp,
>                                 "No IDENTIFY after reselection\n");
>                 goto out_stuck;
>         /*
> @@ -4460,7 +4467,7 @@ static void sym_int_sir(struct sym_hcb *np)
>         case SIR_RESEL_ABORTED:
>                 np->lastmsg = np->msgout[0];
>                 np->msgout[0] = M_NOOP;
> -               scmd_printk(KERN_WARNING, cp->cmd,
> +               sym_printk(KERN_WARNING, tp, cp,
>                         "message %x sent on bad reselection\n", np->lastmsg);
>                 goto out;
>         /*
> --
> 1.8.3.1
>


-- 
With Best Regards,
Andy Shevchenko