Messages in this thread Patch in this message | | | From | YE Chengfeng <> | Subject | 回复: [PATCH] driver/ata: fix potential nul l pointer dereference on pointer last sge | Date | Tue, 26 Oct 2021 10:14:35 +0000 |
| |
Got it. Thanks for your reply in such detail.
Best Regards, Chengfeng
-----邮件原件----- 发件人: Damien Le Moal <damien.lemoal@opensource.wdc.com> 发送时间: 2021年10月26日 12:10 收件人: YE Chengfeng <cyeaa@connect.ust.hk> 抄送: linux-kernel@vger.kernel.org 主题: Re: [PATCH] driver/ata: fix potential null pointer dereference on pointer last_sge
On 2021/10/25 22:13, Chengfeng Ye wrote: > The pointer cs_desc could be null if the loop is not executed, so > there is a potential NULL-PTR dereference issue. Fix this by adding a > null check before dereference. > > Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk> > --- > drivers/ata/sata_sil24.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c index > 06a1e27c4f84..2bd595da799f 100644 > --- a/drivers/ata/sata_sil24.c > +++ b/drivers/ata/sata_sil24.c > @@ -785,6 +785,8 @@ static inline void sil24_fill_sg(struct ata_queued_cmd *qc, > sge++; > } > > + if (!last_sge) > + return; > last_sge->flags = cpu_to_le32(SGE_TRM); }
I do not think that this fix is necessary: sil24_fill_sg() is called only if the qc has ATA_QCFLAG_DMAMAP set (see sil24_qc_prep()) and that in turn is only set if ata_sg_setup() sees at least one sg entry. So the loop in sil24_fill_sg() will always be executed for qc marked with ATA_QCFLAG_DMAMAP and so last_sg cannot be NULL.
-- Damien Le Moal Western Digital Research
| |