2022-04-14 15:06:12

by Xiaomeng Tong

Subject: [RESEND][PATCH] scsi: dc395x: fix a missing check on list iterator

The bug is here:
p->target_id, p->target_lun);

The list iterator 'p' will point to a bogus position containing
HEAD if the list is empty or no element is found. This case must
be checked before any use of the iterator, otherwise it will
lead to a invalid memory access.

To fix this bug, add an check. Use a new variable 'iter' as the
list iterator, while use the origin variable 'p' as a dedicated
pointer to point to the found element.

Cc: [email protected]
Fixes: ^1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xiaomeng Tong <[email protected]>
---
drivers/scsi/dc395x.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index c11916b8ae00..bbc03190a6f2 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -3588,10 +3588,19 @@ static struct DeviceCtlBlk *device_alloc(struct AdapterCtlBlk *acb,
#endif
if (dcb->target_lun != 0) {
/* Copy settings */
- struct DeviceCtlBlk *p;
- list_for_each_entry(p, &acb->dcb_list, list)
- if (p->target_id == dcb->target_id)
+ struct DeviceCtlBlk *p = NULL, *iter;
+
+ list_for_each_entry(iter, &acb->dcb_list, list)
+ if (iter->target_id == dcb->target_id) {
+ p = iter;
break;
+ }
+
+ if (!p) {
+ kfree(dcb);
+ return NULL;
+ }
+
dprintkdbg(DBG_1,
"device_alloc: <%02i-%i> copy from <%02i-%i>\n",
dcb->target_id, dcb->target_lun,
--
2.17.1

2022-04-26 13:23:17

by Martin K. Petersen

Subject: Re: [RESEND][PATCH] scsi: dc395x: fix a missing check on list iterator

Xiaomeng,

> The bug is here:
> p->target_id, p->target_lun);
>
> The list iterator 'p' will point to a bogus position containing HEAD
> if the list is empty or no element is found. This case must be checked
> before any use of the iterator, otherwise it will lead to a invalid
> memory access.
>
> To fix this bug, add an check. Use a new variable 'iter' as the list
> iterator, while use the origin variable 'p' as a dedicated pointer to
> point to the found element.

Applied to 5.19/scsi-staging, thanks!

--
Martin K. Petersen Oracle Linux Engineering

2022-05-03 09:53:53

by Martin K. Petersen

Subject: Re: [RESEND][PATCH] scsi: dc395x: fix a missing check on list iterator

On Thu, 14 Apr 2022 12:02:31 +0800, Xiaomeng Tong wrote:

> The bug is here:
> p->target_id, p->target_lun);
>
> The list iterator 'p' will point to a bogus position containing
> HEAD if the list is empty or no element is found. This case must
> be checked before any use of the iterator, otherwise it will
> lead to a invalid memory access.
>
> [...]

Applied to 5.19/scsi-queue, thanks!

[1/1] scsi: dc395x: fix a missing check on list iterator
https://git.kernel.org/mkp/scsi/c/036a45aa587a

--
Martin K. Petersen Oracle Linux Engineering