Sender: Paolo Bonzini <paolo.bonzini@gmail.com>
Message-ID: <ecb2f3c6-af8c-dd43-1dcf-0b5e8a9d8848@redhat.com>
Date:   Tue, 30 Nov 2021 18:35:52 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.0
Subject: Re: [PATCH] scsi: virtio_scsi: Fix a NULL pointer dereference in
 virtscsi_rescan_hotunplug()
Content-Language: en-US
To:     Zhou Qingyang <zhou1615@umn.edu>
Cc:     kjlu@umn.edu, "Michael S. Tsirkin" <mst@redhat.com>,
        Jason Wang <jasowang@redhat.com>,
        Stefan Hajnoczi <stefanha@redhat.com>,
        "James E.J. Bottomley" <jejb@linux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        Matt Lupfer <mlupfer@ddn.com>,
        virtualization@lists.linux-foundation.org,
        linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20211130171901.202229-1-zhou1615@umn.edu>
From:   Paolo Bonzini <pbonzini@redhat.com>
In-Reply-To: <20211130171901.202229-1-zhou1615@umn.edu>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 11/30/21 18:19, Zhou Qingyang wrote:
> --- a/drivers/scsi/virtio_scsi.c
> +++ b/drivers/scsi/virtio_scsi.c
> @@ -337,7 +337,11 @@ static void virtscsi_rescan_hotunplug(struct virtio_scsi *vscsi)
>   	unsigned char scsi_cmd[MAX_COMMAND_SIZE];
>   	int result, inquiry_len, inq_result_len = 256;
>   	char *inq_result = kmalloc(inq_result_len, GFP_KERNEL);
> -
> +	if (!inq_result) {
> +		pr_err("%s:no enough memory for inq_result\n",
> +			__func__);
> +		return;
> +	}
>   	shost_for_each_device(sdev, shost) {
>   		inquiry_len = sdev->inquiry_len ? sdev->inquiry_len : 36;
>   

In practice this will never happen, since the kmalloc is very small, so 
I think it's easier to just return early without a printk.  On the other 
hand, if the out-of-memory really could happen, this should be a 
pr_err_ratelimited.

Paolo