| Message ID | 1566279789-58207-1-git-send-email-zhengbin13@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | scsi: fcoe: fix null-ptr-deref Read in fc_release_transport | expand |
ping On 2019/8/20 13:43, zhengbin wrote: > In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions) > fails, need to free the previously memory and return fail, > otherwise will trigger null-ptr-deref Read in fc_release_transport. > > fcoe_exit > fcoe_if_exit > fc_release_transport(fcoe_vport_scsi_transport) > > Reported-by: Hulk Robot <hulkci@huawei.com> > Signed-off-by: zhengbin <zhengbin13@huawei.com> > --- > drivers/scsi/fcoe/fcoe.c | 16 +++++++++++----- > 1 file changed, 11 insertions(+), 5 deletions(-) > > diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c > index 00dd47b..2f82e56 100644 > --- a/drivers/scsi/fcoe/fcoe.c > +++ b/drivers/scsi/fcoe/fcoe.c > @@ -1250,15 +1250,21 @@ static int __init fcoe_if_init(void) > /* attach to scsi transport */ > fcoe_nport_scsi_transport = > fc_attach_transport(&fcoe_nport_fc_functions); > + if (!fcoe_nport_scsi_transport) > + goto err; > + > fcoe_vport_scsi_transport = > fc_attach_transport(&fcoe_vport_fc_functions); > - > - if (!fcoe_nport_scsi_transport) { > - printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n"); > - return -ENODEV; > - } > + if (!fcoe_vport_scsi_transport) > + goto err_vport; > > return 0; > + > +err_vport: > + fc_release_transport(fcoe_nport_scsi_transport); > +err: > + printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n"); > + return -ENODEV; > } > > /** > -- > 2.7.4 > > > . >
On 9/4/19 10:51 AM, zhengbin (A) wrote: > ping > > On 2019/8/20 13:43, zhengbin wrote: >> In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions) >> fails, need to free the previously memory and return fail, >> otherwise will trigger null-ptr-deref Read in fc_release_transport. >> >> fcoe_exit >> fcoe_if_exit >> fc_release_transport(fcoe_vport_scsi_transport) >> >> Reported-by: Hulk Robot <hulkci@huawei.com> >> Signed-off-by: zhengbin <zhengbin13@huawei.com> >> --- >> drivers/scsi/fcoe/fcoe.c | 16 +++++++++++----- >> 1 file changed, 11 insertions(+), 5 deletions(-) >> [ .. ] >> > > Reviewed-by: Hannes Reinecke <hare@suse.com> Cheers, Hannes
zhengbin, > In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions) > fails, need to free the previously memory and return fail, > otherwise will trigger null-ptr-deref Read in fc_release_transport. Applied to 5.4/scsi-queue. Thank you.
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c index 00dd47b..2f82e56 100644 --- a/drivers/scsi/fcoe/fcoe.c +++ b/drivers/scsi/fcoe/fcoe.c @@ -1250,15 +1250,21 @@ static int __init fcoe_if_init(void) /* attach to scsi transport */ fcoe_nport_scsi_transport = fc_attach_transport(&fcoe_nport_fc_functions); + if (!fcoe_nport_scsi_transport) + goto err; + fcoe_vport_scsi_transport = fc_attach_transport(&fcoe_vport_fc_functions); - - if (!fcoe_nport_scsi_transport) { - printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n"); - return -ENODEV; - } + if (!fcoe_vport_scsi_transport) + goto err_vport; return 0; + +err_vport: + fc_release_transport(fcoe_nport_scsi_transport); +err: + printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n"); + return -ENODEV; } /**
In fcoe_if_init, if fc_attach_transport(&fcoe_vport_fc_functions) fails, need to free the previously memory and return fail, otherwise will trigger null-ptr-deref Read in fc_release_transport. fcoe_exit fcoe_if_exit fc_release_transport(fcoe_vport_scsi_transport) Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: zhengbin <zhengbin13@huawei.com> --- drivers/scsi/fcoe/fcoe.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) -- 2.7.4