This is a note to let you know that I've just added the patch titled
scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit e0283e08ac2ffb59ada8df7f9febdfb2554189f3
Author: Danila Chernetsov <listdansp@xxxxxxx>
Date: Fri Mar 17 17:51:09 2023 +0000
scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ]
When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is
dereferenced below.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling")
Signed-off-by: Danila Chernetsov <listdansp@xxxxxxx>
Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@xxxxxxx
Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 7dd6dd74d2bc2..6122cc60a8b3d 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -1443,6 +1443,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status)
*/
if (cmdid == CMDID_INT_CMDS) {
scb = &adapter->int_scb;
+ cmd = scb->cmd;
list_del_init(&scb->list);
scb->state = SCB_FREE;
