linux-kernel - [PATCH -next] scsi: be2iscsi: fix null-ptr-deref in beiscsi_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220727072132.3906922-1-yebin10@huawei.com>
Date:   Wed, 27 Jul 2022 15:21:32 +0800
From:   Ye Bin <yebin10@...wei.com>
To:     <jejb@...ux.ibm.com>, <martin.petersen@...cle.com>,
        <linux-scsi@...r.kernel.org>, <linux-kernel@...r.kernel.org>
CC:     Ye Bin <yebin10@...wei.com>
Subject: [PATCH -next] scsi: be2iscsi: fix null-ptr-deref in beiscsi_alloc_mem

Coccicheck report follow issue:
./drivers/scsi/be2iscsi/be_main.c:2561:37-41: ERROR: mem_descr -> mem_array is NULL but dereferenced.
./drivers/scsi/be2iscsi/be_main.c:2563:9-24: ERROR: mem_descr -> mem_array is NULL but dereferenced.
./drivers/scsi/be2iscsi/be_main.c:2566:9-20: ERROR: mem_descr -> mem_array is NULL but dereferenced.

If goto free_mem, that's mean last "mem_descr->mem_array" is NULL. However,
to avoid resource there will set "mem_descr->num_elements" with "j" which
maybe non-zero. Then will lead to null-ptr-deref when free dma resource.

To solved above issue set "mem_descr->mem_array" with "mem_arr_orig"
when free memory.

Signed-off-by: Ye Bin <yebin10@...wei.com>
---
 drivers/scsi/be2iscsi/be_main.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 50a577ac3bb4..08f856447b4a 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -2540,13 +2540,13 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
 				mem_arr++;
 			}
 		} while (alloc_size);
-		mem_descr->num_elements = j;
-		mem_descr->size_in_bytes = phba->mem_req[i];
 		mem_descr->mem_array = kmalloc_array(j, sizeof(*mem_arr),
 						     GFP_KERNEL);
 		if (!mem_descr->mem_array)
 			goto free_mem;
 
+		mem_descr->num_elements = j;
+		mem_descr->size_in_bytes = phba->mem_req[i];
 		memcpy(mem_descr->mem_array, mem_arr_orig,
 		       sizeof(struct mem_array) * j);
 		mem_descr++;
@@ -2554,7 +2554,11 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
 	kfree(mem_arr_orig);
 	return 0;
 free_mem:
-	mem_descr->num_elements = j;
+	if (j) {
+		mem_descr->num_elements = j;
+		mem_descr->mem_array = mem_arr_orig;
+		mem_arr_orig = NULL;
+	}
 	while ((i) || (j)) {
 		for (j = mem_descr->num_elements; j > 0; j--) {
 			dma_free_coherent(&phba->pcidev->dev,
-- 
2.31.1