Messages in this thread | | | Subject | Re: [PATCH] scsi: libfc: Fix a NULL pointer dereference in fc_lport_ptp_setup() | From | Hannes Reinecke <> | Date | Wed, 1 Dec 2021 07:41:19 +0100 |
| |
On 11/30/21 6:10 PM, Zhou Qingyang wrote: > In fc_lport_ptp_setup(), fc_rport_create() is assigned to > lport->ptp_rdata and there is a dereference of in fc_lport_ptp_setup(), > which could lead to a NULL pointer dereference on failure of > fc_rport_create(). > > Fix this bug by adding a check of fc_rport_create(). > > This bug was found by a static analyzer. The analysis employs > differential checking to identify inconsistent security operations > (e.g., checks or kfrees) between two code paths and confirms that the > inconsistent operations are not recovered in the current function or > the callers, so they constitute bugs. > > Note that, as a bug found by static analysis, it can be a false > positive or hard to trigger. Multiple researchers have cross-reviewed > the bug. > > Builds with CONFIG_LIBFC=m show no new warnings, > and our static analyzer no longer warns about this code. > > Fixes: 2580064b5ec6 ("scsi: libfc: Replace ->rport_create callback with function call") > Signed-off-by: Zhou Qingyang <zhou1615@umn.edu> > --- > drivers/scsi/libfc/fc_lport.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c > index 19cd4a95d354..5cd716afb711 100644 > --- a/drivers/scsi/libfc/fc_lport.c > +++ b/drivers/scsi/libfc/fc_lport.c > @@ -241,6 +241,13 @@ static void fc_lport_ptp_setup(struct fc_lport *lport, > } > mutex_lock(&lport->disc.disc_mutex); > lport->ptp_rdata = fc_rport_create(lport, remote_fid); > + if (!lport->ptp_rdata) { > + mutex_unlock(&lport->disc.disc_mutex); > + printk(KERN_WARNING "libfc: Failed to allocate for the port (%6.6x)\n", > + remote_fid); > + return; > + } > + > kref_get(&lport->ptp_rdata->kref); > lport->ptp_rdata->ids.port_name = remote_wwpn; > lport->ptp_rdata->ids.node_name = remote_wwnn; > Reviewed-by: Hannes Reinecke <hare@suse.de>
Cheers,
Hannes -- Dr. Hannes Reinecke Kernel Storage Architect hare@suse.de +49 911 74053 688 SUSE Software Solutions GmbH, Maxfeldstr. 5, 90409 Nürnberg HRB 36809 (AG Nürnberg), Geschäftsführer: Felix Imendörffer
| |