In iscsi_check_tmf_restrictions() task->hdr is dereferenced
to print the opcode, it is possible that task->hdr is NULL.
There are two cases based on opcode argument -
1. ISCSI_OP_SCSI_CMD - In this case alloc_pdu() is called
after iscsi_check_tmf_restrictions()
iscsi_prep_scsi_cmd_pdu() -> iscsi_check_tmf_restrictions() ->
alloc_pdu().
Transport drivers allocate memory for iSCSI hdr in alloc_pdu()
and assign it to task->hdr. In case of TMF task->hdr will be NULL
resulting in NULL pointer dereference.
2. ISCSI_OP_SCSI_DATA_OUT - In this case transport driver
can free the memory for iSCSI hdr after transmitting the pdu
so task->hdr can be NULL or invalid.
This patch fixes this issue by removing task->hdr->opcode
from the printk statement.
Signed-off-by: Varun Prakash <varun@xxxxxxxxxxx>
---
drivers/scsi/libiscsi.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index d609383..c972cc2 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -284,11 +284,11 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
*/
if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
iscsi_conn_printk(KERN_INFO, conn,
- "task [op %x/%x itt "
+ "task [op %x itt "
"0x%x/0x%x] "
"rejected.\n",
- task->hdr->opcode, opcode,
- task->itt, task->hdr_itt);
+ opcode, task->itt,
+ task->hdr_itt);
return -EACCES;
}
/*
@@ -297,10 +297,10 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
*/
if (conn->session->fast_abort) {
iscsi_conn_printk(KERN_INFO, conn,
- "task [op %x/%x itt "
+ "task [op %x itt "
"0x%x/0x%x] fast abort.\n",
- task->hdr->opcode, opcode,
- task->itt, task->hdr_itt);
+ opcode, task->itt,
+ task->hdr_itt);
return -EACCES;
}
break;
--
2.0.2
