[PATCH] scsi: fcoe: fix null-ptr-deref Read in fc_release_transport

[PATCH] scsi: fcoe: fix null-ptr-deref Read in fc_release_transport

[zhengbin]

In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions)
fails, need to free the previously memory and return fail,
otherwise will trigger null-ptr-deref Read in fc_release_transport.

fcoe_exit
  fcoe_if_exit
    fc_release_transport(fcoe_vport_scsi_transport)

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: zhengbin <zhengbin13@huawei.com>
---
 drivers/scsi/fcoe/fcoe.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index 00dd47b..2f82e56 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -1250,15 +1250,21 @@ static int __init fcoe_if_init(void)
 	/* attach to scsi transport */
 	fcoe_nport_scsi_transport =
 		fc_attach_transport(&fcoe_nport_fc_functions);
+	if (!fcoe_nport_scsi_transport)
+		goto err;
+
 	fcoe_vport_scsi_transport =
 		fc_attach_transport(&fcoe_vport_fc_functions);
-
-	if (!fcoe_nport_scsi_transport) {
-		printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n");
-		return -ENODEV;
-	}
+	if (!fcoe_vport_scsi_transport)
+		goto err_vport;

 	return 0;
+
+err_vport:
+	fc_release_transport(fcoe_nport_scsi_transport);
+err:
+	printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n");
+	return -ENODEV;
 }

 /**
--
2.7.4

Re: [PATCH] scsi: fcoe: fix null-ptr-deref Read in fc_release_transport

[zhengbin (A)]

ping

On 2019/8/20 13:43, zhengbin wrote:
> In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions)
> fails, need to free the previously memory and return fail,
> otherwise will trigger null-ptr-deref Read in fc_release_transport.
>
> fcoe_exit
>   fcoe_if_exit
>     fc_release_transport(fcoe_vport_scsi_transport)
>
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: zhengbin <zhengbin13@huawei.com>
> ---
>  drivers/scsi/fcoe/fcoe.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
> index 00dd47b..2f82e56 100644
> --- a/drivers/scsi/fcoe/fcoe.c
> +++ b/drivers/scsi/fcoe/fcoe.c
> @@ -1250,15 +1250,21 @@ static int __init fcoe_if_init(void)
>  	/* attach to scsi transport */
>  	fcoe_nport_scsi_transport =
>  		fc_attach_transport(&fcoe_nport_fc_functions);
> +	if (!fcoe_nport_scsi_transport)
> +		goto err;
> +
>  	fcoe_vport_scsi_transport =
>  		fc_attach_transport(&fcoe_vport_fc_functions);
> -
> -	if (!fcoe_nport_scsi_transport) {
> -		printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n");
> -		return -ENODEV;
> -	}
> +	if (!fcoe_vport_scsi_transport)
> +		goto err_vport;
>
>  	return 0;
> +
> +err_vport:
> +	fc_release_transport(fcoe_nport_scsi_transport);
> +err:
> +	printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n");
> +	return -ENODEV;
>  }
>
>  /**
> --
> 2.7.4
>
>
> .
>

Re: [PATCH] scsi: fcoe: fix null-ptr-deref Read in fc_release_transport

[Hannes Reinecke]

On 9/4/19 10:51 AM,  zhengbin (A)  wrote:
> ping
> 
> On 2019/8/20 13:43, zhengbin wrote:
>> In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions)
>> fails, need to free the previously memory and return fail,
>> otherwise will trigger null-ptr-deref Read in fc_release_transport.
>>
>> fcoe_exit
>>   fcoe_if_exit
>>     fc_release_transport(fcoe_vport_scsi_transport)
>>
>> Reported-by: Hulk Robot <hulkci@huawei.com>
>> Signed-off-by: zhengbin <zhengbin13@huawei.com>
>> ---
>>  drivers/scsi/fcoe/fcoe.c | 16 +++++++++++-----
>>  1 file changed, 11 insertions(+), 5 deletions(-)
>>
[ .. ]
>>
> 
> 
Reviewed-by: Hannes Reinecke <hare@suse.com>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke		      Teamlead Storage & Networking
hare@suse.de			                  +49 911 74053 688
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg
HRB 247165 (AG München), GF: Felix Imendörffer

Re: [PATCH] scsi: fcoe: fix null-ptr-deref Read in fc_release_transport

[Martin K. Petersen]

zhengbin,

> In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions)
> fails, need to free the previously memory and return fail,
> otherwise will trigger null-ptr-deref Read in fc_release_transport.

Applied to 5.4/scsi-queue. Thank you.

-- 
Martin K. Petersen	Oracle Linux Engineering