lkml.org 
[lkml]   [2018]   [Sep]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 007/107] scsi: libiscsi: fix possible NULL pointer dereference in case of TMF
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Varun Prakash <varun@chelsio.com>

    [ Upstream commit a17037e7d59075053b522048742a08ac9500bde8 ]

    In iscsi_check_tmf_restrictions() task->hdr is dereferenced to print the
    opcode, it is possible that task->hdr is NULL.

    There are two cases based on opcode argument:

    1. ISCSI_OP_SCSI_CMD - In this case alloc_pdu() is called
    after iscsi_check_tmf_restrictions()

    iscsi_prep_scsi_cmd_pdu() -> iscsi_check_tmf_restrictions() -> alloc_pdu().

    Transport drivers allocate memory for iSCSI hdr in alloc_pdu() and assign
    it to task->hdr. In case of TMF task->hdr will be NULL resulting in NULL
    pointer dereference.

    2. ISCSI_OP_SCSI_DATA_OUT - In this case transport driver can free the
    memory for iSCSI hdr after transmitting the pdu so task->hdr can be NULL or
    invalid.

    This patch fixes this issue by removing task->hdr->opcode from the printk
    statement.

    Signed-off-by: Varun Prakash <varun@chelsio.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/scsi/libiscsi.c | 12 ++++++------
    1 file changed, 6 insertions(+), 6 deletions(-)

    --- a/drivers/scsi/libiscsi.c
    +++ b/drivers/scsi/libiscsi.c
    @@ -283,11 +283,11 @@ static int iscsi_check_tmf_restrictions(
    */
    if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
    iscsi_conn_printk(KERN_INFO, conn,
    - "task [op %x/%x itt "
    + "task [op %x itt "
    "0x%x/0x%x] "
    "rejected.\n",
    - task->hdr->opcode, opcode,
    - task->itt, task->hdr_itt);
    + opcode, task->itt,
    + task->hdr_itt);
    return -EACCES;
    }
    /*
    @@ -296,10 +296,10 @@ static int iscsi_check_tmf_restrictions(
    */
    if (conn->session->fast_abort) {
    iscsi_conn_printk(KERN_INFO, conn,
    - "task [op %x/%x itt "
    + "task [op %x itt "
    "0x%x/0x%x] fast abort.\n",
    - task->hdr->opcode, opcode,
    - task->itt, task->hdr_itt);
    + opcode, task->itt,
    + task->hdr_itt);
    return -EACCES;
    }
    break;

    \
     
     \ /
      Last update: 2018-09-03 19:06    [W:4.275 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site