Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [PATCH -next] scsi: be2iscsi: fix null-ptr-deref in
 beiscsi_alloc_mem
To:     <jejb@linux.ibm.com>, <martin.petersen@oracle.com>,
        <linux-scsi@vger.kernel.org>, <linux-kernel@vger.kernel.org>
References: <20220727072132.3906922-1-yebin10@huawei.com>
From:   yebin <yebin10@huawei.com>
Message-ID: <63075C4F.3010506@huawei.com>
Date:   Thu, 25 Aug 2022 19:26:07 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.1.0
MIME-Version: 1.0
In-Reply-To: <20220727072132.3906922-1-yebin10@huawei.com>
Content-Type: text/plain; charset="windows-1252"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

ping...

On 2022/7/27 15:21, Ye Bin wrote:
> Coccicheck report follow issue:
> ./drivers/scsi/be2iscsi/be_main.c:2561:37-41: ERROR: mem_descr -> mem_array is NULL but dereferenced.
> ./drivers/scsi/be2iscsi/be_main.c:2563:9-24: ERROR: mem_descr -> mem_array is NULL but dereferenced.
> ./drivers/scsi/be2iscsi/be_main.c:2566:9-20: ERROR: mem_descr -> mem_array is NULL but dereferenced.
>
> If goto free_mem, that's mean last "mem_descr->mem_array" is NULL. However,
> to avoid resource there will set "mem_descr->num_elements" with "j" which
> maybe non-zero. Then will lead to null-ptr-deref when free dma resource.
>
> To solved above issue set "mem_descr->mem_array" with "mem_arr_orig"
> when free memory.
>
> Signed-off-by: Ye Bin <yebin10@huawei.com>
> ---
>   drivers/scsi/be2iscsi/be_main.c | 10 +++++++---
>   1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
> index 50a577ac3bb4..08f856447b4a 100644
> --- a/drivers/scsi/be2iscsi/be_main.c
> +++ b/drivers/scsi/be2iscsi/be_main.c
> @@ -2540,13 +2540,13 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
>   				mem_arr++;
>   			}
>   		} while (alloc_size);
> -		mem_descr->num_elements = j;
> -		mem_descr->size_in_bytes = phba->mem_req[i];
>   		mem_descr->mem_array = kmalloc_array(j, sizeof(*mem_arr),
>   						     GFP_KERNEL);
>   		if (!mem_descr->mem_array)
>   			goto free_mem;
>   
> +		mem_descr->num_elements = j;
> +		mem_descr->size_in_bytes = phba->mem_req[i];
>   		memcpy(mem_descr->mem_array, mem_arr_orig,
>   		       sizeof(struct mem_array) * j);
>   		mem_descr++;
> @@ -2554,7 +2554,11 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
>   	kfree(mem_arr_orig);
>   	return 0;
>   free_mem:
> -	mem_descr->num_elements = j;
> +	if (j) {
> +		mem_descr->num_elements = j;
> +		mem_descr->mem_array = mem_arr_orig;
> +		mem_arr_orig = NULL;
> +	}
>   	while ((i) || (j)) {
>   		for (j = mem_descr->num_elements; j > 0; j--) {
>   			dma_free_coherent(&phba->pcidev->dev,