Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
IronPort-SDR: /46JUq41C58pS/XPGVD405yu2dODTenMFwI/1rewtK3eFUEyer/GyBjcbD49cztMQ1NBrsd3dg
 pAIOYx5MQeF7oDNHw2tsUv1YWUet8D2KbttdqTyK+p9wo4HRect6QQVOkxbrbq9IbZ8qQvbyFg
 rS9yyP1PBagPkFmZYju1Q9dmw4KqKR2e191cYXOyoYLS9U3w0zPD//eylGWCT+1thymXQ0RX1Z
 ZuwEzME1nWYrlWRNMvVT9jn+gtUW/kPSMLTGd3VmYCN0Ifava6AobupI4onjVHwfOdkX0yuwwk
 Q2G8VyN/tlWvAy5mSZifgOkj
IronPort-SDR: EVyasxcVkmOunkc8QD21bhBZfarPCW+Wa0CWemiCh6GQS795DdVCKt/4Gi1Heo7cxIucEFTcTx
 jBDhx06wwBYOtHNWDNJlHCKhqYtO7zM0kl3UpmU9/cwRWlBEYPdr/PalJUQ47FwfnH2rl8b0De
 arapTHUIJNoUCUIxyif0FlnBI4YsKgpn8xY0xghooervGfAAUko+7aIS3xN89AzO1Q10TI1+6C
 uqzXLG5/+t1bJAB5+4bRn2S7WSQ3Zu/xv1d7gwbsKBap1cemOXng4ea3qu/ca8iQrmB7MapDH/
 f78=
WDCIronportException: Internal
Message-ID: <3f35b011-4aab-4c9e-4a0d-220d7babba5d@opensource.wdc.com>
Date:   Fri, 27 May 2022 16:15:24 +0900
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.9.0
From:   Damien Le Moal <damien.lemoal@opensource.wdc.com>
Subject: Re: Null Pointer Dereference in sd_zbc_release_disk
To:     Dongliang Mu <mudongliangabcd@gmail.com>, jejb@linux.ibm.com,
        martin.petersen@oracle.com, linux-scsi@vger.kernel.org,
        linux-kernel <linux-kernel@vger.kernel.org>
References: <CAD-N9QXY57RvFwGQvh8U7WBc3JCX-0kpqB6+fZ=oJJtHmFdUwg@mail.gmail.com>
Content-Language: en-US
Organization: Western Digital Research
In-Reply-To: <CAD-N9QXY57RvFwGQvh8U7WBc3JCX-0kpqB6+fZ=oJJtHmFdUwg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2022/05/27 14:51, Dongliang Mu wrote:
> Hi maintainers,
> 
> I found a NPD(Null Pointer Dereference) in sd_zbc_release_disk function.
> 
> There are two definitions of sd_zbc_release_disk:
> 
> #ifdef CONFIG_BLK_DEV_ZONED
> void sd_zbc_release_disk(struct scsi_disk *sdkp);
> #else /* CONFIG_BLK_DEV_ZONED */
> static inline void sd_zbc_release_disk(struct scsi_disk *sdkp) {}
> #endif
> 
> When CONFIG_BLK_DEV_ZONED=y, the function implementation is as follows:
> 
> void sd_zbc_release_disk(struct scsi_disk *sdkp)
> {
>     if (sd_is_zoned(sdkp))
>         sd_zbc_clear_zone_info(sdkp);
> }
> 
> static inline int sd_is_zoned(struct scsi_disk *sdkp)
> {
>     return sdkp->zoned == 1 || sdkp->device->type == TYPE_ZBC;
> }
> 
> In drivers/scsi/sd.c, sd_probe() allocates sdkp with kzalloc(). If
> errors occurred before the assignment "sdkp->device", after the
> allocation, it will triggers a NPD in sd_is_zoned.
> 
> I am not familiar with kernel configuration. Does anyone have a
> suggestion to fix this NPD?
> 
> I really appreciate any help you can provide.

Can you try this patch:

 From 875899a114bce34f9549857ce87ea309b366b1cb Mon Sep 17 00:00:00 2001
From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Date: Fri, 27 May 2022 16:07:20 +0900
Subject: [PATCH] scsi: sd_zbc: Fix potential NULL pointer dereference

If sd_probe() sees an error before sdkp->device is initialized,
sd_zbc_release_disk() is called, which causes a NULL pointer dereference
when sd_is_zoned() is called. Avoid this by turning
sd_zbc_release_disk() into a nop if sdkp->device is NULL.

Reported-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
---
  drivers/scsi/sd_zbc.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 5b9fad70aa88..236a766c8de4 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -804,7 +804,7 @@ static void sd_zbc_clear_zone_info(struct scsi_disk 
*sdkp)

  void sd_zbc_release_disk(struct scsi_disk *sdkp)
  {
-	if (sd_is_zoned(sdkp))
+	if (sdkp->device && sd_is_zoned(sdkp))
  		sd_zbc_clear_zone_info(sdkp);
  }

-- 
2.36.1


-- 
Damien Le Moal
Western Digital Research