diff options
author | Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com> | 2020-06-07 19:58:32 +0000 |
---|---|---|
committer | Martin K. Petersen <martin.petersen@oracle.com> | 2020-06-09 21:57:26 -0400 |
commit | 9e95fb805dc043cc8ed878a08d1583e4097a5f80 (patch) | |
tree | aec0b1d8d8cfeadc9748ad4913974fe1bde1f714 /drivers/target/target_core_xcopy.c | |
parent | a36840d8002736060f96386cf5dd148f0b0d4fa3 (diff) | |
download | linux-stable-9e95fb805dc043cc8ed878a08d1583e4097a5f80.tar.gz linux-stable-9e95fb805dc043cc8ed878a08d1583e4097a5f80.tar.bz2 linux-stable-9e95fb805dc043cc8ed878a08d1583e4097a5f80.zip |
scsi: target: Fix NULL pointer dereference
NULL pointer dereference happens when the following conditions are met:
1) A SCSI command is received for a non-existing LU or cdb initialization
fails in target_setup_cmd_from_cdb().
2) Tracing is enabled.
The following call sequences lead to NULL pointer dereference:
1) iscsit_setup_scsi_cmd
transport_lookup_cmd_lun <-- lookup fails.
or
target_setup_cmd_from_cdb() <-- cdb initialization fails
iscsit_process_scsi_cmd
iscsit_sequence_cmd
transport_send_check_condition_and_sense
trace_target_cmd_complete <-- NULL dereference
2) target_submit_cmd_map_sgls
transport_lookup_cmd_lun <-- lookup fails
or
target_setup_cmd_from_cdb() <-- cdb initialization fails
transport_send_check_condition_and_sense
trace_target_cmd_complete <-- NULL dereference
In the above sequence, cmd->t_task_cdb is uninitialized which when
referenced in trace_target_cmd_complete() causes NULL pointer dereference.
The fix is to use the helper, target_cmd_init_cdb() and call it after
transport_init_se_cmd() is called, so that cmd->t_task_cdb can be
initialized and hence can be referenced in trace_target_cmd_complete().
Link: https://lore.kernel.org/r/1591559913-8388-4-git-send-email-sudhakar.panneerselvam@oracle.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/target/target_core_xcopy.c')
-rw-r--r-- | drivers/target/target_core_xcopy.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c index 5f1bab37a6bf..7f9c93b5cba6 100644 --- a/drivers/target/target_core_xcopy.c +++ b/drivers/target/target_core_xcopy.c @@ -526,6 +526,9 @@ static int target_xcopy_setup_pt_cmd( } cmd->se_cmd_flags |= SCF_SE_LUN_CMD; + if (target_cmd_init_cdb(cmd, cdb)) + return -EINVAL; + cmd->tag = 0; if (target_setup_cmd_from_cdb(cmd, cdb)) return -EINVAL; |