| Message ID | 20220727072132.3906922-1-yebin10@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | [-next] scsi: be2iscsi: fix null-ptr-deref in beiscsi_alloc_mem | expand |
ping... On 2022/7/27 15:21, Ye Bin wrote: > Coccicheck report follow issue: > ./drivers/scsi/be2iscsi/be_main.c:2561:37-41: ERROR: mem_descr -> mem_array is NULL but dereferenced. > ./drivers/scsi/be2iscsi/be_main.c:2563:9-24: ERROR: mem_descr -> mem_array is NULL but dereferenced. > ./drivers/scsi/be2iscsi/be_main.c:2566:9-20: ERROR: mem_descr -> mem_array is NULL but dereferenced. > > If goto free_mem, that's mean last "mem_descr->mem_array" is NULL. However, > to avoid resource there will set "mem_descr->num_elements" with "j" which > maybe non-zero. Then will lead to null-ptr-deref when free dma resource. > > To solved above issue set "mem_descr->mem_array" with "mem_arr_orig" > when free memory. > > Signed-off-by: Ye Bin <yebin10@huawei.com> > --- > drivers/scsi/be2iscsi/be_main.c | 10 +++++++--- > 1 file changed, 7 insertions(+), 3 deletions(-) > > diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c > index 50a577ac3bb4..08f856447b4a 100644 > --- a/drivers/scsi/be2iscsi/be_main.c > +++ b/drivers/scsi/be2iscsi/be_main.c > @@ -2540,13 +2540,13 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba) > mem_arr++; > } > } while (alloc_size); > - mem_descr->num_elements = j; > - mem_descr->size_in_bytes = phba->mem_req[i]; > mem_descr->mem_array = kmalloc_array(j, sizeof(*mem_arr), > GFP_KERNEL); > if (!mem_descr->mem_array) > goto free_mem; > > + mem_descr->num_elements = j; > + mem_descr->size_in_bytes = phba->mem_req[i]; > memcpy(mem_descr->mem_array, mem_arr_orig, > sizeof(struct mem_array) * j); > mem_descr++; > @@ -2554,7 +2554,11 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba) > kfree(mem_arr_orig); > return 0; > free_mem: > - mem_descr->num_elements = j; > + if (j) { > + mem_descr->num_elements = j; > + mem_descr->mem_array = mem_arr_orig; > + mem_arr_orig = NULL; > + } > while ((i) || (j)) { > for (j = mem_descr->num_elements; j > 0; j--) { > dma_free_coherent(&phba->pcidev->dev,
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c index 50a577ac3bb4..08f856447b4a 100644 --- a/drivers/scsi/be2iscsi/be_main.c +++ b/drivers/scsi/be2iscsi/be_main.c @@ -2540,13 +2540,13 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba) mem_arr++; } } while (alloc_size); - mem_descr->num_elements = j; - mem_descr->size_in_bytes = phba->mem_req[i]; mem_descr->mem_array = kmalloc_array(j, sizeof(*mem_arr), GFP_KERNEL); if (!mem_descr->mem_array) goto free_mem; + mem_descr->num_elements = j; + mem_descr->size_in_bytes = phba->mem_req[i]; memcpy(mem_descr->mem_array, mem_arr_orig, sizeof(struct mem_array) * j); mem_descr++; @@ -2554,7 +2554,11 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba) kfree(mem_arr_orig); return 0; free_mem: - mem_descr->num_elements = j; + if (j) { + mem_descr->num_elements = j; + mem_descr->mem_array = mem_arr_orig; + mem_arr_orig = NULL; + } while ((i) || (j)) { for (j = mem_descr->num_elements; j > 0; j--) { dma_free_coherent(&phba->pcidev->dev,
Coccicheck report follow issue: ./drivers/scsi/be2iscsi/be_main.c:2561:37-41: ERROR: mem_descr -> mem_array is NULL but dereferenced. ./drivers/scsi/be2iscsi/be_main.c:2563:9-24: ERROR: mem_descr -> mem_array is NULL but dereferenced. ./drivers/scsi/be2iscsi/be_main.c:2566:9-20: ERROR: mem_descr -> mem_array is NULL but dereferenced. If goto free_mem, that's mean last "mem_descr->mem_array" is NULL. However, to avoid resource there will set "mem_descr->num_elements" with "j" which maybe non-zero. Then will lead to null-ptr-deref when free dma resource. To solved above issue set "mem_descr->mem_array" with "mem_arr_orig" when free memory. Signed-off-by: Ye Bin <yebin10@huawei.com> --- drivers/scsi/be2iscsi/be_main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)