Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chengfeng Ye <cyeaa@connect.ust.hk>
To:     damien.lemoal@opensource.wdc.com
Cc:     linux-kernel@vger.kernel.org, Chengfeng Ye <cyeaa@connect.ust.hk>
Subject: [PATCH] driver/ata: fix potential null pointer dereference on pointer last_sge
Date:   Mon, 25 Oct 2021 06:13:04 -0700
Message-Id: <20211025131304.17226-1-cyeaa@connect.ust.hk>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?HbAZS3sCK9PsMW/zwHeXxOcAOPDqnh6toZbVoyc3ORxQSCUTXM86QQf9CiwC?=
 =?us-ascii?Q?7aFh2z6T3GDi1v8p/BQvkASglUgDFPiEZx+B/INLWMvu3qBglJiNXwXKPikl?=
 =?us-ascii?Q?X/6bCn0nsfrCwJscgcWAirrcG7wbOP2tinKdosagXXrHgnd/smQdU/kp0c/F?=
 =?us-ascii?Q?8RcH95fa5kk78xXQeWxChfOHnpuEvDbsbjXfaar98NQ/FvqLIEEgkLXiYA2Q?=
 =?us-ascii?Q?xLbk7/6b1YYvsiFMsKY150xQWkzIRne3Q8kL7YsKebXpvDaJpWokXPuf9eA5?=
 =?us-ascii?Q?pEPSwxiM4GqyGVxcc+wlyG+zE4sCmS6DOCLbd/OtpqzlbNCK7Mzy4yYpwnUg?=
 =?us-ascii?Q?51yCo6VYajsRtV2Eng5HU14q7I+yGspdhMmIKlDfMzQ+cguBfoD2MmbuuMIw?=
 =?us-ascii?Q?NGmjj1mwOYG5bYl8oOcUE63TQYM3/8RdSFqLklirrD/pDbNmZs0TDqfOoImr?=
 =?us-ascii?Q?njSpzlqGUxrjiCSwovGl/hmThvgQdOPWCx+yoN8YNTtl3H28hF+ahPH+Uudj?=
 =?us-ascii?Q?2jEVF7sdNd4MWXFpm/z9tSRNFzkHpsQrvprZZJlXZ1CJ32o56Lqd5uKsfWeg?=
 =?us-ascii?Q?5XNcASa5mrmVLr+T04KCyr7s3pv5Xk4GC16MKJdH1LWKu1kB/Jk3sde4eelZ?=
 =?us-ascii?Q?vs7cJL8UnBp5ez57LCHIbtdU6z2Kr8HJao30GYFQdgVqe+shKogcGv4OfFOO?=
 =?us-ascii?Q?9BelHMeKrzumR5Vgc+evhbAfoJhHbTAkodRbjMcm+Ghez+XM6yTGUhugEJsY?=
 =?us-ascii?Q?NpNtuIqPnD7w8dlZhZpykO3g3/NUeINmOMjqTB9I7v/UHFae4soEoO3qRfmH?=
 =?us-ascii?Q?0ZjYuISqCZUDVMprXVj2gPVRKVGbajeU3nRcgo+iAyAJdP4iUGHaXXfKHU7o?=
 =?us-ascii?Q?3lwdtpDxT2+PDIxjWtTK+XMFDCCXUtr9OE1FWPBX0D4Y5ZJzu/Gcmu7U2Hc3?=
 =?us-ascii?Q?+9nISfYR114SSZcJOFFMoOo6bzSMnPqoDkDElXIdldvRKMccnEVSTwvfMWRX?=
 =?us-ascii?Q?CrwuSlgs0XFHS0jrlGe5Rrn/TyLR8X5vkfQI82t6Zoz3QezywA7oZLlwYaOe?=
 =?us-ascii?Q?7Eg34Hh9g67tFWudRFOvRJqbJWFom7YXfwXekY3rgW4EM24v7fUo+S+rRI+c?=
 =?us-ascii?Q?iUwevSlbiiiBjB8AFhBKkp9+0rh1+ESwYAEGsds4D52iiLgOZ0BgF+D0tTI3?=
 =?us-ascii?Q?COt4EBT0O4UCdmbNDDRbPc6gIdxzwG9N/J0bBVdYh/WpLdTpiClljLRQXR6d?=
 =?us-ascii?Q?9icod36tv4Xm/oyS4nOUCwgdw9UJz0dJscwDPyTSreIVz2yF9zEsx9CC5fSh?=
 =?us-ascii?Q?htyUsgLbgPXfaTATcfLNBA7wTtVurwzPlYd9dMAoMtUSI4tfJIM/U0P4Kjnl?=
 =?us-ascii?Q?QWbo/0mkIzpdDCn982wP3qfGn1+XysPTGRBiJ5DP4urekr3QlGu+h1z0+P5J?=
 =?us-ascii?Q?dVx7ZJcjcBhFhlrob1K5TG8k7g++RUSgKVi1GXhcSFZso3BT5QeYDSjElKAZ?=
 =?us-ascii?Q?oCIIjnCw38j6tPt74YWHnorP8FIQAmG8qZZchOTMfVoeKwxfZJJjf5RZHjA0?=
 =?us-ascii?Q?e5/FjddcWwP1jYwQkvqqAM6ZLW6OtBwsOUegxJwqRFeMBSURqS4evCui0Y4S?=
 =?us-ascii?Q?HRL2UlML+jphi5yW6XN8r+g=3D?=
X-OriginatorOrg: connect.ust.hk
X-MS-Exchange-CrossTenant-Network-Message-Id: 7c8b7409-6204-4405-d248-08d997b93310
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Oct 2021 13:13:13.3937
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6c1d4152-39d0-44ca-88d9-b8d6ddca0708
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: xED4h8ahNAhWowSgvotbZrSvhjWcL1Ni8O6YMTSKZ2+TzdYh8/CZMYnwVktdUM/Lq19k654LuZjk0sgX2ZWoKg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYBP286MB0016
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The pointer cs_desc could be null if the loop is not
executed, so there is a potential NULL-PTR dereference
issue. Fix this by adding a null check before dereference.

Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 drivers/ata/sata_sil24.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index 06a1e27c4f84..2bd595da799f 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -785,6 +785,8 @@ static inline void sil24_fill_sg(struct ata_queued_cmd *qc,
 		sge++;
 	}
 
+	if (!last_sge)
+		return;
 	last_sge->flags = cpu_to_le32(SGE_TRM);
 }
 
-- 
2.17.1