Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28aaa950 authored by Nicholas Bellinger's avatar Nicholas Bellinger
Browse files

iscsi-target: Fix potential NULL pointer in solicited NOPOUT reject 



This patch addresses a potential NULL pointer dereference regression in
iscsit_setup_nop_out() code, specifically for two cases when a solicited
NOPOUT triggers a ISCSI_REASON_PROTOCOL_ERROR reject to be generated.

This is because iscsi_cmd is expected to be NULL for solicited NOPOUT
case before iscsit_process_nop_out() locates the descriptor via TTT
using iscsit_find_cmd_from_ttt().

This regression was originally introduced in:

commit ba159914
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date:   Wed Jul 3 03:48:24 2013 -0700

    iscsi-target: Fix iscsit_add_reject* usage for iser

Cc: stable@vger.kernel.org  # 3.10+
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent c9a03c12

drivers/target/iscsi/iscsi_target.c

+8 −0
Original line number Diff line number Diff line
@@ -1522,6 +1522,10 @@ int iscsit_setup_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd, 
	if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {

		pr_err("NOPOUT ITT is reserved, but Immediate Bit is"

			" not set, protocol error.\n");

		if (!cmd)

			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,

						 (unsigned char *)hdr);



		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,

					 (unsigned char *)hdr);

	}
@@ -1531,6 +1535,10 @@ int iscsit_setup_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd, 
			" greater than MaxXmitDataSegmentLength: %u, protocol"

			" error.\n", payload_length,

			conn->conn_ops->MaxXmitDataSegmentLength);

		if (!cmd)

			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,

						 (unsigned char *)hdr);



		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,

					 (unsigned char *)hdr);

	}