tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

scsi: target: Reset t_task_cdb pointer in error case

If allocation of cmd->t_task_cdb fails, it remains NULL but is later
dereferenced in the 'err' path.

In case of error, reset NULL t_task_cdb value to point at the default
fixed-size buffer.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 9e95fb805dc0 ("scsi: target: Fix NULL pointer dereference")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Link: https://patch.msgid.link/20251118084014.324940-1-a.vatoropin@crpt.ru
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

Andrey Vatoropin and committed by
Martin K. Petersen 5053eab3 b4bb6daf

+1
+1
drivers/target/target_core_transport.c
··· 1524 1524 if (scsi_command_size(cdb) > sizeof(cmd->__t_task_cdb)) { 1525 1525 cmd->t_task_cdb = kzalloc(scsi_command_size(cdb), gfp); 1526 1526 if (!cmd->t_task_cdb) { 1527 + cmd->t_task_cdb = &cmd->__t_task_cdb[0]; 1527 1528 pr_err("Unable to allocate cmd->t_task_cdb" 1528 1529 " %u > sizeof(cmd->__t_task_cdb): %lu ops\n", 1529 1530 scsi_command_size(cdb),