lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 10 Aug 2021 09:18:41 +0200 From: Bodo Stroesser <bostroesser@...il.com> To: Tuo Li <islituo@...il.com>, martin.petersen@...cle.com Cc: linux-scsi@...r.kernel.org, target-devel@...r.kernel.org, linux-kernel@...r.kernel.org, baijiaju1990@...il.com, TOTE Robot <oslab@...nghua.edu.cn> Subject: Re: [PATCH v2] scsi: target: pscsi: Fix possible null-pointer dereference in pscsi_complete_cmd() On 10.08.21 06:04, Tuo Li wrote: > The return value of transport_kmap_data_sg() is assigned to the variable > buf: > buf = transport_kmap_data_sg(cmd); > > And then it is checked: > if (!buf) { > > This indicates that buf can be NULL. However, it is dereferenced in the > following statements: > if (!(buf[3] & 0x80)) > buf[3] |= 0x80; > if (!(buf[2] & 0x80)) > buf[2] |= 0x80; > > To fix these possible null-pointer dereferences, dereference buf and call > transport_kunmap_data_sg() only when buf is not NULL. > > Reported-by: TOTE Robot <oslab@...nghua.edu.cn> > Signed-off-by: Tuo Li <islituo@...il.com> > --- > v2: > * Put transport_kunmap_data_sg() into the else-branch of the if (!bug). > Thank Bodo Stroesser for helpful advice. > --- > drivers/target/target_core_pscsi.c | 18 +++++++++--------- > 1 file changed, 9 insertions(+), 9 deletions(-) > > diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c > index 2629d2ef3970..75ef52f008ff 100644 > --- a/drivers/target/target_core_pscsi.c > +++ b/drivers/target/target_core_pscsi.c > @@ -620,17 +620,17 @@ static void pscsi_complete_cmd(struct se_cmd *cmd, u8 scsi_status, > buf = transport_kmap_data_sg(cmd); > if (!buf) { > ; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */ > - } > - > - if (cdb[0] == MODE_SENSE_10) { > - if (!(buf[3] & 0x80)) > - buf[3] |= 0x80; > } else { > - if (!(buf[2] & 0x80)) > - buf[2] |= 0x80; > - } > + if (cdb[0] == MODE_SENSE_10) { > + if (!(buf[3] & 0x80)) > + buf[3] |= 0x80; > + } else { > + if (!(buf[2] & 0x80)) > + buf[2] |= 0x80; > + } > > - transport_kunmap_data_sg(cmd); > + transport_kunmap_data_sg(cmd); > + } > } > } > after_mode_sense: > Reviewed-by: Bodo Stroesser <bostroesser@...il.com> Regards, Bodo
Powered by blists - more mailing lists