On 2/3/21 4:19 AM, Dan Carpenter wrote:
> Hi Mike,
> 
> url:    https://github.com/0day-ci/linux/commits/Mike-Christie/iscsi-fixes-and-cleanups/20210203-122757
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git for-next
> config: i386-randconfig-m021-20210202 (attached as .config)
> compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
> 
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> smatch warnings:
> drivers/scsi/libiscsi_tcp.c:586 iscsi_tcp_r2t_rsp() warn: variable dereferenced before check 'task->sc' (see line 547)
> 
> vim +586 drivers/scsi/libiscsi_tcp.c
> 
> f7dbf0662a0167 Mike Christie     2021-02-02  529  static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
> a081c13e39b5c1 Mike Christie     2008-12-02  530  {
> a081c13e39b5c1 Mike Christie     2008-12-02  531  	struct iscsi_session *session = conn->session;
> f7dbf0662a0167 Mike Christie     2021-02-02  532  	struct iscsi_tcp_task *tcp_task;
> f7dbf0662a0167 Mike Christie     2021-02-02  533  	struct iscsi_tcp_conn *tcp_conn;
> f7dbf0662a0167 Mike Christie     2021-02-02  534  	struct iscsi_r2t_rsp *rhdr;
> a081c13e39b5c1 Mike Christie     2008-12-02  535  	struct iscsi_r2t_info *r2t;
> f7dbf0662a0167 Mike Christie     2021-02-02  536  	struct iscsi_task *task;
> 5d0fddd0a72d30 Shlomo Pongratz   2014-02-07  537  	u32 data_length;
> 5d0fddd0a72d30 Shlomo Pongratz   2014-02-07  538  	u32 data_offset;
> f7dbf0662a0167 Mike Christie     2021-02-02  539  	int r2tsn;
> a081c13e39b5c1 Mike Christie     2008-12-02  540  	int rc;
> a081c13e39b5c1 Mike Christie     2008-12-02  541  
> f7dbf0662a0167 Mike Christie     2021-02-02  542  	spin_lock(&session->back_lock);
> f7dbf0662a0167 Mike Christie     2021-02-02  543  	task = iscsi_itt_to_ctask(conn, hdr->itt);
> f7dbf0662a0167 Mike Christie     2021-02-02  544  	if (!task) {
> f7dbf0662a0167 Mike Christie     2021-02-02  545  		spin_unlock(&session->back_lock);
> f7dbf0662a0167 Mike Christie     2021-02-02  546  		return ISCSI_ERR_BAD_ITT;
> f7dbf0662a0167 Mike Christie     2021-02-02 @547  	} else if (task->sc->sc_data_direction != DMA_TO_DEVICE) {
>                                                                    ^^^^^^^^
> New unchecked dereference.

I see the issue. iscsi_itt_ctask checks task->sc and if NULL returns NULL.
However, below in this function there is now a not needed task->sc check.
The checker saw that and thinks the above line could be a invalid access.

I'll fix the patch by removing the old check since it's confusing code
that's also not needed since it's done for us now.