| Message ID | 20250612101556.24829-1-mlombard@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port | expand |
On 6/12/25 5:15 AM, Maurizio Lombardi wrote: > The function core_scsi3_decode_spec_i_port(), in its error code path, > unconditionally calls core_scsi3_lunacl_undepend_item() > passing the dest_se_deve pointer, which may be NULL. > > This can lead to a NULL pointer dereference if > dest_se_deve remains unset. > > SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg > Unable to handle kernel paging request at virtual address dfff800000000012 > Call trace: > core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) > core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] > core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] > target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] > > Fix this by adding a NULL check before calling > core_scsi3_lunacl_undepend_item() > > Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Reviewed-by: Mike Christie <michael.christie@oracle.com>
This bug reported by one of our customers just the other day. Maurizio turned around the fix in less than a day. Great job Maurizio! Reviewed-by: John Meneghini <jmeneghi@redhat.com> On 6/12/25 6:15 AM, Maurizio Lombardi wrote: > The function core_scsi3_decode_spec_i_port(), in its error code path, > unconditionally calls core_scsi3_lunacl_undepend_item() > passing the dest_se_deve pointer, which may be NULL. > > This can lead to a NULL pointer dereference if > dest_se_deve remains unset. > > SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg > Unable to handle kernel paging request at virtual address dfff800000000012 > Call trace: > core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) > core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] > core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] > target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] > > Fix this by adding a NULL check before calling > core_scsi3_lunacl_undepend_item() > > Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> > --- > drivers/target/target_core_pr.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c > index 34cf2c399b39..70905805cb17 100644 > --- a/drivers/target/target_core_pr.c > +++ b/drivers/target/target_core_pr.c > @@ -1842,7 +1842,9 @@ core_scsi3_decode_spec_i_port( > } > > kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); > - core_scsi3_lunacl_undepend_item(dest_se_deve); > + > + if (dest_se_deve) > + core_scsi3_lunacl_undepend_item(dest_se_deve); > > if (is_local) > continue;
On Thu, 12 Jun 2025 12:15:56 +0200, Maurizio Lombardi wrote: > The function core_scsi3_decode_spec_i_port(), in its error code path, > unconditionally calls core_scsi3_lunacl_undepend_item() > passing the dest_se_deve pointer, which may be NULL. > > This can lead to a NULL pointer dereference if > dest_se_deve remains unset. > > [...] Applied to 6.16/scsi-fixes, thanks! [1/1] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port https://git.kernel.org/mkp/scsi/c/d8ab68bdb294
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index 34cf2c399b39..70905805cb17 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -1842,7 +1842,9 @@ core_scsi3_decode_spec_i_port( } kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); - core_scsi3_lunacl_undepend_item(dest_se_deve); + + if (dest_se_deve) + core_scsi3_lunacl_undepend_item(dest_se_deve); if (is_local) continue;
The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> --- drivers/target/target_core_pr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)