Fwd: [PATCH] fixing null dereference in scsi

[T. Williams]

---------- Forwarded message ---------
From: docfate111 <tdwill...@gmail.com>
Date: Wed, Oct 6, 2021 at 4:22 PM
Subject: [PATCH] fixing null dereference in scsi
To: <dan.ro...@starlab.io>

---
 drivers/scsi/scsi_lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 572673873ddf..9abaacd6db67 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1174,7 +1174,7 @@ static blk_status_t scsi_setup_scsi_cmnd(struct scsi_device *sdev,
        }

        cmd->cmd_len = scsi_req(req)->cmd_len;
-       if (cmd->cmd_len == 0)
+       if (cmd->cmd_len == 0 && cmd->cmnd)
                cmd->cmd_len = scsi_command_size(cmd->cmnd);
        cmd->cmnd = scsi_req(req)->cmd;
        cmd->transfersize = blk_rq_bytes(req);
--
2.25.1
A user could be able to set cmd->cmnd as NULL and then scsi_command_size
dereferences the null pointer.

--

Thank you for your time,

Thelford Williams