diff options
| author | Xiaomeng Tong <xiam0nd.tong@gmail.com> | 2022-04-14 06:02:31 +0200 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2022-04-26 14:51:56 +0200 |
| commit | 036a45aa587a10fa2abbd50fbd0f6c4cfc44f69f (patch) | |
| tree | e3087deb2d87155d478a64e0b8be10837e1ddb17 /drivers/scsi | |
| parent | scsi: qedf: Remove an unneeded NULL check on list iterator (diff) | |
| download | linux-036a45aa587a10fa2abbd50fbd0f6c4cfc44f69f.tar.xz linux-036a45aa587a10fa2abbd50fbd0f6c4cfc44f69f.zip | |
scsi: dc395x: Fix a missing check on list iterator
The bug is here:
p->target_id, p->target_lun);
The list iterator 'p' will point to a bogus position containing HEAD if the
list is empty or no element is found. This case must be checked before any
use of the iterator, otherwise it will lead to an invalid memory access.
To fix this bug, add a check. Use a new variable 'iter' as the list
iterator, and use the original variable 'p' as a dedicated pointer to point
to the found element.
Link: https://lore.kernel.org/r/20220414040231.2662-1-xiam0nd.tong@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi')
| -rw-r--r-- | drivers/scsi/dc395x.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c index 67a89715c863..670a836a6ba1 100644 --- a/drivers/scsi/dc395x.c +++ b/drivers/scsi/dc395x.c @@ -3585,10 +3585,19 @@ static struct DeviceCtlBlk *device_alloc(struct AdapterCtlBlk *acb, #endif if (dcb->target_lun != 0) { /* Copy settings */ - struct DeviceCtlBlk *p; - list_for_each_entry(p, &acb->dcb_list, list) - if (p->target_id == dcb->target_id) + struct DeviceCtlBlk *p = NULL, *iter; + + list_for_each_entry(iter, &acb->dcb_list, list) + if (iter->target_id == dcb->target_id) { + p = iter; break; + } + + if (!p) { + kfree(dcb); + return NULL; + } + dprintkdbg(DBG_1, "device_alloc: <%02i-%i> copy from <%02i-%i>\n", dcb->target_id, dcb->target_lun, |