2014-07-03 18:09:14

by Joe Lawrence

[permalink] [raw]
Subject: Re: [PATCH] scsi: mpt2sas: mpt2sas_base.c: Fix for possible null pointer dereference

On Wed, 28 May 2014, Christoph Hellwig wrote:

> > - ioc_status = le16_to_cpu(mpi_reply->IOCStatus) & MPI2_IOCSTATUS_MASK;
> > + if (mpi_reply) {
> > + ioc_status = le16_to_cpu(mpi_reply->IOCStatus) & MPI2_IOCSTATUS_MASK;
> > + }
> >
> > if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
> > ioc->port_enable_failed = 1;
>
> ioc_status isn't initialized without the reply and used here as well
> as later in the function. I think we'll need input from LSI or others
> with the spec on what to do when we didn't get a reply.

Any update on this?

The mpt3 version checks for !mpi_reply and returns 1. Which leads to
another question -- should mpt{2,3}sas_port_enable_done ever return 0 (as their
respective comments describe)?

Regards,

-- Joe


2014-07-03 18:45:22

by Rickard Strandqvist

[permalink] [raw]
Subject: Re: [PATCH] scsi: mpt2sas: mpt2sas_base.c: Fix for possible null pointer dereference

2014-07-03 19:45 GMT+02:00 Joe Lawrence <[email protected]>:
> On Wed, 28 May 2014, Christoph Hellwig wrote:
>
>> > - ioc_status = le16_to_cpu(mpi_reply->IOCStatus) & MPI2_IOCSTATUS_MASK;
>> > + if (mpi_reply) {
>> > + ioc_status = le16_to_cpu(mpi_reply->IOCStatus) & MPI2_IOCSTATUS_MASK;
>> > + }
>> >
>> > if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
>> > ioc->port_enable_failed = 1;
>>
>> ioc_status isn't initialized without the reply and used here as well
>> as later in the function. I think we'll need input from LSI or others
>> with the spec on what to do when we didn't get a reply.
>
> Any update on this?
>
> The mpt3 version checks for !mpi_reply and returns 1. Which leads to
> another question -- should mpt{2,3}sas_port_enable_done ever return 0 (as their
> respective comments describe)?
>
> Regards,
>
> -- Joe


Hi

Good questions Joe!
And good someone else brought this up, because I guess it's not meant to me.

And it looks however now that I've done quite a few more patches that
there should not have been any {}
And then, it is perhaps good to sett a start value for ioc_status. My
suggestion is:

u16 ioc_status = MPI2_IOCSTATUS_OP_STATE_NOT_SUPPORTED;


Kind regards
Rickard Strandqvist