* [PATCH] scsi: megaraid: Fix possible null-pointer dereferences in megasas_complete_cmd()
@ 2019-07-29 2:54 Jia-Ju Bai
0 siblings, 0 replies; only message in thread
From: Jia-Ju Bai @ 2019-07-29 2:54 UTC (permalink / raw)
To: kashyap.desai, sumit.saxena, shivasharan.srikanteshwara, jejb,
martin.petersen
Cc: megaraidlinux.pdl, linux-scsi, linux-kernel, Jia-Ju Bai
In megasas_complete_cmd(), there is an if statement on line 3411 to
check whether cmd->scmd is NULL:
if (cmd->scmd)
When cmd->scmd is NULL, it is used at some places, such as on line 3286:
cmd->scmd->result = alt_status << 16;
on line 3295:
cmd->scmd->scsi_done(cmd->scmd);
on line 3343:
cmd->scmd->scsi_done(cmd->scmd);
Thus, possible null-pointer dereferences may occur.
To fix these bugs, cmd->scmd is checked before being used.
These bugs are found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index b2339d04a700..181c4d9cd707 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3440,6 +3440,9 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
case MFI_CMD_LD_READ:
case MFI_CMD_LD_WRITE:
+ if (!cmd->scmd)
+ break;
+
if (alt_status) {
cmd->scmd->result = alt_status << 16;
exception = 1;
--
2.17.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2019-07-29 2:54 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-29 2:54 [PATCH] scsi: megaraid: Fix possible null-pointer dereferences in megasas_complete_cmd() Jia-Ju Bai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).