lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 565/667] scsi: dc395x: Fix a missing check on list iterator
    Date
    From: Xiaomeng Tong <xiam0nd.tong@gmail.com>

    commit 036a45aa587a10fa2abbd50fbd0f6c4cfc44f69f upstream.

    The bug is here:

    p->target_id, p->target_lun);

    The list iterator 'p' will point to a bogus position containing HEAD if the
    list is empty or no element is found. This case must be checked before any
    use of the iterator, otherwise it will lead to an invalid memory access.

    To fix this bug, add a check. Use a new variable 'iter' as the list
    iterator, and use the original variable 'p' as a dedicated pointer to point
    to the found element.

    Link: https://lore.kernel.org/r/20220414040231.2662-1-xiam0nd.tong@gmail.com
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable@vger.kernel.org
    Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/scsi/dc395x.c | 15 ++++++++++++---
    1 file changed, 12 insertions(+), 3 deletions(-)

    --- a/drivers/scsi/dc395x.c
    +++ b/drivers/scsi/dc395x.c
    @@ -3590,10 +3590,19 @@ static struct DeviceCtlBlk *device_alloc
    #endif
    if (dcb->target_lun != 0) {
    /* Copy settings */
    - struct DeviceCtlBlk *p;
    - list_for_each_entry(p, &acb->dcb_list, list)
    - if (p->target_id == dcb->target_id)
    + struct DeviceCtlBlk *p = NULL, *iter;
    +
    + list_for_each_entry(iter, &acb->dcb_list, list)
    + if (iter->target_id == dcb->target_id) {
    + p = iter;
    break;
    + }
    +
    + if (!p) {
    + kfree(dcb);
    + return NULL;
    + }
    +
    dprintkdbg(DBG_1,
    "device_alloc: <%02i-%i> copy from <%02i-%i>\n",
    dcb->target_id, dcb->target_lun,

    \
     
     \ /
      Last update: 2022-06-07 22:04    [W:3.035 / U:0.908 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site