Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 03b14708 authored by Jiri Slaby's avatar Jiri Slaby Committed by James Bottomley
Browse files

[SCSI] scsi_lib: fix potential NULL dereference 



Stanse found a potential NULL dereference in scsi_kill_request.

Instead of triggering BUG() in 'if (unlikely(cmd == NULL))' branch,
the kernel will Oops earlier on cmd dereference.

Move the dereferences after the if.

Signed-off-by: default avatarJiri Slaby <jirislaby@gmail.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent f619106b

drivers/scsi/scsi_lib.c

+6 −3
Original line number Diff line number Diff line
@@ -1359,9 +1359,9 @@ static int scsi_lld_busy(struct request_queue *q) 
static void scsi_kill_request(struct request *req, struct request_queue *q)

{

	struct scsi_cmnd *cmd = req->special;

	struct scsi_device *sdev = cmd->device;

	struct scsi_target *starget = scsi_target(sdev);

	struct Scsi_Host *shost = sdev->host;

	struct scsi_device *sdev;

	struct scsi_target *starget;

	struct Scsi_Host *shost;



	blk_start_request(req);
@@ -1371,6 +1371,9 @@ static void scsi_kill_request(struct request *req, struct request_queue *q) 
		BUG();

	}



	sdev = cmd->device;

	starget = scsi_target(sdev);

	shost = sdev->host;

	scsi_init_cmd_errh(cmd);

	cmd->result = DID_NO_CONNECT << 16;

	atomic_inc(&cmd->device->iorequest_cnt);