Commit 671f9ee9 authored by Daniel Palmer's avatar Daniel Palmer Committed by Cheng Yu
Browse files

scsi: wd33c93: Don't use stale scsi_pointer value

stable inclusion
from stable-v6.6.57
commit e04642a207f1d2ae28a08624c04c67f5681f3451
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE0
CVE: CVE-2024-50026

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e04642a207f1d2ae28a08624c04c67f5681f3451



--------------------------------

commit 9023ed8d91eb1fcc93e64dc4962f7412b1c4cbec upstream.

A regression was introduced with commit dbb2da55 ("scsi: wd33c93:
Move the SCSI pointer to private command data") which results in an oops
in wd33c93_intr(). That commit added the scsi_pointer variable and
initialized it from hostdata->connected. However, during selection,
hostdata->connected is not yet valid. Fix this by getting the current
scsi_pointer from hostdata->selecting.

Cc: Daniel Palmer <daniel@0x0f.com>
Cc: Michael Schmitz <schmitzmic@gmail.com>
Cc: stable@kernel.org
Fixes: dbb2da55 ("scsi: wd33c93: Move the SCSI pointer to private command data")
Signed-off-by: default avatarDaniel Palmer <daniel@0x0f.com>
Co-developed-by: default avatarFinn Thain <fthain@linux-m68k.org>
Signed-off-by: default avatarFinn Thain <fthain@linux-m68k.org>
Link: https://lore.kernel.org/r/09e11a0a54e6aa2a88bd214526d305aaf018f523.1727926187.git.fthain@linux-m68k.org


Reviewed-by: default avatarMichael Schmitz <schmitzmic@gmail.com>
Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarCheng Yu <serein.chengyu@huawei.com>
parent 740bb65d
Loading
Loading
Loading
Loading
+1 −1
Original line number Diff line number Diff line
@@ -831,7 +831,7 @@ wd33c93_intr(struct Scsi_Host *instance)
		/* construct an IDENTIFY message with correct disconnect bit */

		hostdata->outgoing_msg[0] = IDENTIFY(0, cmd->device->lun);
		if (scsi_pointer->phase)
		if (WD33C93_scsi_pointer(cmd)->phase)
			hostdata->outgoing_msg[0] |= 0x40;

		if (hostdata->sync_stat[cmd->device->id] == SS_FIRST) {