linux-kernel - [PATCH] scsi: megaraid: Fix possible null-pointer dereferences in megasas_complete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 29 Jul 2019 10:54:45 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     kashyap.desai@...adcom.com, sumit.saxena@...adcom.com,
        shivasharan.srikanteshwara@...adcom.com, jejb@...ux.ibm.com,
        martin.petersen@...cle.com
Cc:     megaraidlinux.pdl@...adcom.com, linux-scsi@...r.kernel.org,
        linux-kernel@...r.kernel.org, Jia-Ju Bai <baijiaju1990@...il.com>
Subject: [PATCH] scsi: megaraid: Fix possible null-pointer dereferences in megasas_complete_cmd()

In megasas_complete_cmd(), there is an if statement on line 3411 to
check whether cmd->scmd is NULL:
    if (cmd->scmd)

When cmd->scmd is NULL, it is used at some places, such as on line 3286:
    cmd->scmd->result = alt_status << 16;
on line 3295:
    cmd->scmd->scsi_done(cmd->scmd);
on line 3343:
    cmd->scmd->scsi_done(cmd->scmd);

Thus, possible null-pointer dereferences may occur.

To fix these bugs, cmd->scmd is checked before being used.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@...il.com>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index b2339d04a700..181c4d9cd707 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3440,6 +3440,9 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
 	case MFI_CMD_LD_READ:
 	case MFI_CMD_LD_WRITE:
 
+		if (!cmd->scmd)
+			break;
+
 		if (alt_status) {
 			cmd->scmd->result = alt_status << 16;
 			exception = 1;
-- 
2.17.0