Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 03b147083a2f9a2a3fbbd2505fa88ffa3c6ab194

Authored by Jiri Slaby
Committed by James Bottomley
1 parent f619106bdd
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

[SCSI] scsi_lib: fix potential NULL dereference 

Stanse found a potential NULL dereference in scsi_kill_request.

Instead of triggering BUG() in 'if (unlikely(cmd == NULL))' branch,
the kernel will Oops earlier on cmd dereference.

Move the dereferences after the if.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

Showing 1 changed file with 6 additions and 3 deletions Side-by-side Diff

drivers/scsi/scsi_lib.c
Diff comments   View file @ 03b1470
... ... @@ -1359,9 +1359,9 @@
1359 1359 static void scsi_kill_request(struct request *req, struct request_queue *q)
1360 1360 {
1361 1361 struct scsi_cmnd *cmd = req->special;
1362   - struct scsi_device *sdev = cmd->device;
1363   - struct scsi_target *starget = scsi_target(sdev);
1364   - struct Scsi_Host *shost = sdev->host;
  1362 + struct scsi_device *sdev;
  1363 + struct scsi_target *starget;
  1364 + struct Scsi_Host *shost;
1365 1365  
1366 1366 blk_start_request(req);
1367 1367  
... ... @@ -1371,6 +1371,9 @@
1371 1371 BUG();
1372 1372 }
1373 1373  
  1374 + sdev = cmd->device;
  1375 + starget = scsi_target(sdev);
  1376 + shost = sdev->host;
1374 1377 scsi_init_cmd_errh(cmd);
1375 1378 cmd->result = DID_NO_CONNECT << 16;
1376 1379 atomic_inc(&cmd->device->iorequest_cnt);