Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-ID: <1570481667.4242.4.camel@linux.ibm.com>
Subject: Re: Potential NULL pointer deference in scsi: scsi_transport_spi
From:   James Bottomley <jejb@linux.ibm.com>
To:     Yizhuo Zhai <yzhai003@ucr.edu>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
        Chengyu Song <csong@cs.ucr.edu>,
        Zhiyun Qian <zhiyunq@cs.ucr.edu>
Date:   Mon, 07 Oct 2019 13:54:27 -0700
In-Reply-To: <CABvMjLSoa6WfdmvwCCPgAUtc1ZmQ8+14xrDnz5Q8MrpFstMDsg@mail.gmail.com>
References: <CABvMjLSoa6WfdmvwCCPgAUtc1ZmQ8+14xrDnz5Q8MrpFstMDsg@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, 2019-10-07 at 13:30 -0700, Yizhuo Zhai wrote:
> Hi All:
> 
> drivers/scsi/scsi_transport_spi.c:
> 
> Inside function store_spi_transport_period(), dev_to_shost()
> could return NULL

No, it can't.  The device model ensures that a SCSI target or device
must be parented to a host.

James

> , however, the return value shost is not
> checked and get used. This could potentially be unsafe.
>