scsi_debug: fix sanity check in resp_rsup_opcodes

David Binderman pointed out in this post:

http://marc.info/?l=linux-scsi&m=141924469523474&w=2

a sanity check that was flawed. See attached fix. Should be applied to lk 3.19.0-rc2 and Christoph's branches.

ChangeLog:
fix alloc_len sanity check in resp_rsup_opcodes()

---
 drivers/scsi/scsi_debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Douglas Gilbert <[email protected]>
Date: Mon, 22 Dec 2014 10:16:55 -0500
Subject: [PATCH] scsi_debug sanity check in resp_rsup_opcodes

fix alloc_len sanity check in resp_rsup_opcodes()

---
 drivers/scsi/scsi_debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 7b8b51b..63a2e1f 100644
@@ -1623,7 +1623,7 @@ resp_rsup_opcodes(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
 	req_opcode = cmd[3];
 	req_sa = get_unaligned_be16(cmd + 4);
 	alloc_len = get_unaligned_be32(cmd + 6);
-	if (alloc_len < 4 && alloc_len > 0xffff) {
+	if (alloc_len < 4 || alloc_len > 0xffff) {
 		mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
 		return check_condition_result;
 	}

1.9.1

Hello there,

----------------------------------------

Actually, there is another fault in the same source code file:

Checking drivers/scsi/scsi_debug.c...
[drivers/scsi/scsi_debug.c:3844] -> [drivers/scsi/scsi_debug.c:3846]: (warning) Possible null pointer dereference: cmnd - otherwise it is redundant to check it against null.

Source code is

    struct scsi_device *sdp = cmnd->device;

    if (NULL == cmnd || NULL == devip) {

Suggest postpone use of cmnd until *after* it has been sanity checked.

Regards

David Binderman
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html