2022-07-27 07:24:56

by yebin (H)

Subject: [PATCH -next] scsi: be2iscsi: fix null-ptr-deref in beiscsi_alloc_mem

Coccicheck report follow issue:
./drivers/scsi/be2iscsi/be_main.c:2561:37-41: ERROR: mem_descr -> mem_array is NULL but dereferenced.
./drivers/scsi/be2iscsi/be_main.c:2563:9-24: ERROR: mem_descr -> mem_array is NULL but dereferenced.
./drivers/scsi/be2iscsi/be_main.c:2566:9-20: ERROR: mem_descr -> mem_array is NULL but dereferenced.

If goto free_mem, that's mean last "mem_descr->mem_array" is NULL. However,
to avoid resource there will set "mem_descr->num_elements" with "j" which
maybe non-zero. Then will lead to null-ptr-deref when free dma resource.

To solved above issue set "mem_descr->mem_array" with "mem_arr_orig"
when free memory.

Signed-off-by: Ye Bin <[email protected]>
---
drivers/scsi/be2iscsi/be_main.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 50a577ac3bb4..08f856447b4a 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -2540,13 +2540,13 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
mem_arr++;
}
} while (alloc_size);
- mem_descr->num_elements = j;
- mem_descr->size_in_bytes = phba->mem_req[i];
mem_descr->mem_array = kmalloc_array(j, sizeof(*mem_arr),
GFP_KERNEL);
if (!mem_descr->mem_array)
goto free_mem;

+ mem_descr->num_elements = j;
+ mem_descr->size_in_bytes = phba->mem_req[i];
memcpy(mem_descr->mem_array, mem_arr_orig,
sizeof(struct mem_array) * j);
mem_descr++;
@@ -2554,7 +2554,11 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
kfree(mem_arr_orig);
return 0;
free_mem:
- mem_descr->num_elements = j;
+ if (j) {
+ mem_descr->num_elements = j;
+ mem_descr->mem_array = mem_arr_orig;
+ mem_arr_orig = NULL;
+ }
while ((i) || (j)) {
for (j = mem_descr->num_elements; j > 0; j--) {
dma_free_coherent(&phba->pcidev->dev,
--
2.31.1

2022-08-25 11:28:15

by yebin (H)

Subject: Re: [PATCH -next] scsi: be2iscsi: fix null-ptr-deref in beiscsi_alloc_mem

ping...

On 2022/7/27 15:21, Ye Bin wrote:
> Coccicheck report follow issue:
> ./drivers/scsi/be2iscsi/be_main.c:2561:37-41: ERROR: mem_descr -> mem_array is NULL but dereferenced.
> ./drivers/scsi/be2iscsi/be_main.c:2563:9-24: ERROR: mem_descr -> mem_array is NULL but dereferenced.
> ./drivers/scsi/be2iscsi/be_main.c:2566:9-20: ERROR: mem_descr -> mem_array is NULL but dereferenced.
>
> If goto free_mem, that's mean last "mem_descr->mem_array" is NULL. However,
> to avoid resource there will set "mem_descr->num_elements" with "j" which
> maybe non-zero. Then will lead to null-ptr-deref when free dma resource.
>
> To solved above issue set "mem_descr->mem_array" with "mem_arr_orig"
> when free memory.
>
> Signed-off-by: Ye Bin <[email protected]>
> ---
> drivers/scsi/be2iscsi/be_main.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
> index 50a577ac3bb4..08f856447b4a 100644
> --- a/drivers/scsi/be2iscsi/be_main.c
> +++ b/drivers/scsi/be2iscsi/be_main.c
> @@ -2540,13 +2540,13 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
> mem_arr++;
> }
> } while (alloc_size);
> - mem_descr->num_elements = j;
> - mem_descr->size_in_bytes = phba->mem_req[i];
> mem_descr->mem_array = kmalloc_array(j, sizeof(*mem_arr),
> GFP_KERNEL);
> if (!mem_descr->mem_array)
> goto free_mem;
>
> + mem_descr->num_elements = j;
> + mem_descr->size_in_bytes = phba->mem_req[i];
> memcpy(mem_descr->mem_array, mem_arr_orig,
> sizeof(struct mem_array) * j);
> mem_descr++;
> @@ -2554,7 +2554,11 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
> kfree(mem_arr_orig);
> return 0;
> free_mem:
> - mem_descr->num_elements = j;
> + if (j) {
> + mem_descr->num_elements = j;
> + mem_descr->mem_array = mem_arr_orig;
> + mem_arr_orig = NULL;
> + }
> while ((i) || (j)) {
> for (j = mem_descr->num_elements; j > 0; j--) {
> dma_free_coherent(&phba->pcidev->dev,