p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

scsi: libiscsi: fix possible NULL pointer dereference in case of TMF 

In iscsi_check_tmf_restrictions() task->hdr is dereferenced to print the
opcode, it is possible that task->hdr is NULL.

There are two cases based on opcode argument:

1. ISCSI_OP_SCSI_CMD - In this case alloc_pdu() is called
after iscsi_check_tmf_restrictions()

iscsi_prep_scsi_cmd_pdu() -> iscsi_check_tmf_restrictions() -> alloc_pdu().

Transport drivers allocate memory for iSCSI hdr in alloc_pdu() and assign
it to task->hdr. In case of TMF task->hdr will be NULL resulting in NULL
pointer dereference.

2. ISCSI_OP_SCSI_DATA_OUT - In this case transport driver can free the
memory for iSCSI hdr after transmitting the pdu so task->hdr can be NULL or
invalid.

This patch fixes this issue by removing task->hdr->opcode from the printk
statement.

Signed-off-by: Varun Prakash <varun@chelsio.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Varun Prakash 2018-07-11 22:09:52 +05:30 committed by Martin K. Petersen
parent 1b350ea0c2
commit a17037e7d5
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/scsi/libiscsi.c
View File

@ -284,11 +284,11 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
*/ */
if (opcode != ISCSI_OP_SCSI_DATA_OUT) { if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
iscsi_conn_printk(KERN_INFO, conn, iscsi_conn_printk(KERN_INFO, conn,
"task [op %x/%x itt " "task [op %x itt "
"0x%x/0x%x] " "0x%x/0x%x] "
"rejected.\n", "rejected.\n",
task->hdr->opcode, opcode, opcode, task->itt,
task->itt, task->hdr_itt); task->hdr_itt);
return -EACCES; return -EACCES;
} }
/* /*
@ -297,10 +297,10 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
*/ */
if (conn->session->fast_abort) { if (conn->session->fast_abort) {
iscsi_conn_printk(KERN_INFO, conn, iscsi_conn_printk(KERN_INFO, conn,
"task [op %x/%x itt " "task [op %x itt "
"0x%x/0x%x] fast abort.\n", "0x%x/0x%x] fast abort.\n",
task->hdr->opcode, opcode, opcode, task->itt,
task->itt, task->hdr_itt); task->hdr_itt);
return -EACCES; return -EACCES;
} }
break; break;