linux-kernel - Re: [PATCH] scsi: virtio_scsi: Fix a NULL pointer dereference in virtscsi_rescan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ecb2f3c6-af8c-dd43-1dcf-0b5e8a9d8848@redhat.com>
Date:   Tue, 30 Nov 2021 18:35:52 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Zhou Qingyang <zhou1615@....edu>
Cc:     kjlu@....edu, "Michael S. Tsirkin" <mst@...hat.com>,
        Jason Wang <jasowang@...hat.com>,
        Stefan Hajnoczi <stefanha@...hat.com>,
        "James E.J. Bottomley" <jejb@...ux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Matt Lupfer <mlupfer@....com>,
        virtualization@...ts.linux-foundation.org,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: virtio_scsi: Fix a NULL pointer dereference in
 virtscsi_rescan_hotunplug()

On 11/30/21 18:19, Zhou Qingyang wrote:
> --- a/drivers/scsi/virtio_scsi.c
> +++ b/drivers/scsi/virtio_scsi.c
> @@ -337,7 +337,11 @@ static void virtscsi_rescan_hotunplug(struct virtio_scsi *vscsi)
>   	unsigned char scsi_cmd[MAX_COMMAND_SIZE];
>   	int result, inquiry_len, inq_result_len = 256;
>   	char *inq_result = kmalloc(inq_result_len, GFP_KERNEL);
> -
> +	if (!inq_result) {
> +		pr_err("%s:no enough memory for inq_result\n",
> +			__func__);
> +		return;
> +	}
>   	shost_for_each_device(sdev, shost) {
>   		inquiry_len = sdev->inquiry_len ? sdev->inquiry_len : 36;
>   

In practice this will never happen, since the kmalloc is very small, so 
I think it's easier to just return early without a printk.  On the other 
hand, if the out-of-memory really could happen, this should be a 
pr_err_ratelimited.

Paolo