diff options
| author | Maurizio Lombardi <mlombard@redhat.com> | 2025-06-12 12:15:56 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-07-10 16:03:16 +0200 |
| commit | 55dfffc5e94730370b08de02c0cf3b7c951bbe9e (patch) | |
| tree | a0619307f7c8827be640f6635438baafc4cc05d3 /drivers/target | |
| parent | 7b9203afeb37e52a49a4e1f9042f5d679d8a8f81 (diff) | |
| download | linux-55dfffc5e94730370b08de02c0cf3b7c951bbe9e.tar.gz linux-55dfffc5e94730370b08de02c0cf3b7c951bbe9e.tar.bz2 linux-55dfffc5e94730370b08de02c0cf3b7c951bbe9e.zip | |
scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
[ Upstream commit d8ab68bdb294b09a761e967dad374f2965e1913f ]
The function core_scsi3_decode_spec_i_port(), in its error code path,
unconditionally calls core_scsi3_lunacl_undepend_item() passing the
dest_se_deve pointer, which may be NULL.
This can lead to a NULL pointer dereference if dest_se_deve remains
unset.
SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg
Unable to handle kernel paging request at virtual address dfff800000000012
Call trace:
core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)
core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]
core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]
target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]
Fix this by adding a NULL check before calling
core_scsi3_lunacl_undepend_item()
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Meneghini <jmeneghi@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/target')
| -rw-r--r-- | drivers/target/target_core_pr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index 49d9167bb263..a9eb6a3e8383 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -1841,7 +1841,9 @@ out: } kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); - core_scsi3_lunacl_undepend_item(dest_se_deve); + + if (dest_se_deve) + core_scsi3_lunacl_undepend_item(dest_se_deve); if (is_local) continue; |