2017-09-25 12:01:02

by Johannes Thumshirn

Subject: [PATCH] scsi: fc: check for rport presence in fc_block_scsi_eh

Coverity-scan recently found a possible NULL pointer dereference in
fc_block_scsi_eh() as starget_to_rport() either returns the rport for
the startget or NULL.

While it is rather unlikely to have fc_block_scsi_eh() called without
an rport associated it's a good idea to catch potential misuses of the
API gracefully.

Signed-off-by: Johannes Thumshirn <[email protected]>
---
drivers/scsi/scsi_transport_fc.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index ba9d70f8a6a1..830ce53f30fb 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3328,6 +3328,9 @@ int fc_block_scsi_eh(struct scsi_cmnd *cmnd)
{
struct fc_rport *rport = starget_to_rport(scsi_target(cmnd->device));

+ if (WARN_ON(!rport))
+ return 0;
+
return fc_block_rport(rport);
}
EXPORT_SYMBOL(fc_block_scsi_eh);
--
2.13.5

2017-09-25 23:29:12

by Bart Van Assche

Subject: Re: [PATCH] scsi: fc: check for rport presence in fc_block_scsi_eh

On Mon, 2017-09-25 at 14:00 +0200, Johannes Thumshirn wrote:
> Coverity-scan recently found a possible NULL pointer dereference in
> fc_block_scsi_eh() as starget_to_rport() either returns the rport for
> the startget or NULL.
>
> While it is rather unlikely to have fc_block_scsi_eh() called without
> an rport associated it's a good idea to catch potential misuses of the
> API gracefully.
>
> Signed-off-by: Johannes Thumshirn <[email protected]>
> ---
> drivers/scsi/scsi_transport_fc.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
> index ba9d70f8a6a1..830ce53f30fb 100644
> --- a/drivers/scsi/scsi_transport_fc.c
> +++ b/drivers/scsi/scsi_transport_fc.c
> @@ -3328,6 +3328,9 @@ int fc_block_scsi_eh(struct scsi_cmnd *cmnd)
> {
> struct fc_rport *rport = starget_to_rport(scsi_target(cmnd->device));
>
> + if (WARN_ON(!rport))
> + return 0;
> +
> return fc_block_rport(rport);
> }
> EXPORT_SYMBOL(fc_block_scsi_eh);

Did you perhaps intend to use WARN_ON_ONCE() instead of WARN_ON()? Anyway:

Reviewed-by: Bart Van Assche <[email protected]>

2017-09-26 06:55:20

by Johannes Thumshirn

Subject: Re: [PATCH] scsi: fc: check for rport presence in fc_block_scsi_eh

On Mon, Sep 25, 2017 at 11:29:07PM +0000, Bart Van Assche wrote:
> Did you perhaps intend to use WARN_ON_ONCE() instead of WARN_ON()?

Now that you're saying it. I'll send a v2.

Thanks,
Johannes

--
Johannes Thumshirn Storage
[email protected] +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 N?rnberg
GF: Felix Imend?rffer, Jane Smithard, Graham Norton
HRB 21284 (AG N?rnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850