This is a note to let you know that I've just added the patch titled
SCSI: storvsc: NULL pointer dereference fix
to the 3.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
scsi-storvsc-null-pointer-dereference-fix.patch
and it can be found in the queue-3.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From b12bb60d6c350b348a4e1460cd68f97ccae9822e Mon Sep 17 00:00:00 2001
From: Ales Novak <alnovak@xxxxxxx>
Date: Thu, 27 Feb 2014 11:03:30 +0100
Subject: SCSI: storvsc: NULL pointer dereference fix
From: Ales Novak <alnovak@xxxxxxx>
commit b12bb60d6c350b348a4e1460cd68f97ccae9822e upstream.
If the initialization of storvsc fails, the storvsc_device_destroy()
causes NULL pointer dereference.
storvsc_bus_scan()
scsi_scan_target()
__scsi_scan_target()
scsi_probe_and_add_lun(hostdata=NULL)
scsi_alloc_sdev(hostdata=NULL)
sdev->hostdata = hostdata
now the host allocation fails
__scsi_remove_device(sdev)
calls sdev->host->hostt->slave_destroy() ==
storvsc_device_destroy(sdev)
access of sdev->hostdata->request_mempool
Signed-off-by: Ales Novak <alnovak@xxxxxxx>
Signed-off-by: Thomas Abraham <tabraham@xxxxxxxx>
Reviewed-by: Jiri Kosina <jkosina@xxxxxxx>
Acked-by: K. Y. Srinivasan <kys@xxxxxxxxxxxxx>
Signed-off-by: James Bottomley <JBottomley@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/scsi/storvsc_drv.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1131,6 +1131,9 @@ static void storvsc_device_destroy(struc
{
struct stor_mem_pools *memp = sdevice->hostdata;
+ if (!memp)
+ return;
+
mempool_destroy(memp->request_mempool);
kmem_cache_destroy(memp->request_pool);
kfree(memp);
Patches currently in stable-queue which might be from alnovak@xxxxxxx are
queue-3.4/scsi-storvsc-null-pointer-dereference-fix.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html