---------- Forwarded message ---------
From: docfate111 <[email protected]>
Date: Wed, Oct 6, 2021 at 4:22 PM
Subject: [PATCH] fixing null dereference in scsi
To: <[email protected]>
---
drivers/scsi/scsi_lib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 572673873ddf..9abaacd6db67 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1174,7 +1174,7 @@ static blk_status_t scsi_setup_scsi_cmnd(struct
scsi_device *sdev,
}
cmd->cmd_len = scsi_req(req)->cmd_len;
- if (cmd->cmd_len == 0)
+ if (cmd->cmd_len == 0 && cmd->cmnd)
cmd->cmd_len = scsi_command_size(cmd->cmnd);
cmd->cmnd = scsi_req(req)->cmd;
cmd->transfersize = blk_rq_bytes(req);
--
2.25.1
A user could be able to set cmd->cmnd as NULL and then scsi_command_size
dereferences the null pointer.
--
Thank you for your time,
Thelford Williams
--
You received this message because you are subscribed to the Google Groups
"open-iscsi" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/open-iscsi/CADN%3DF_mobip5EsmWFOfbKFK%2BE8C5ZCEK%3Dfsf4-nEDgeHM3Lx7A%40mail.gmail.com.
