Unverified Commit df2ddcba authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12990 vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Kaixiong Yu <yukaixiong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/CKCTYP3EHST54JKITKFGO3KLELDC4VS5/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYR8T 
 
Link:https://gitee.com/openeuler/kernel/pulls/12990

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 38125a58 b558d622

drivers/vhost/scsi.c

+15 −12
Original line number Diff line number Diff line
@@ -919,20 +919,23 @@ vhost_scsi_get_req(struct vhost_virtqueue *vq, struct vhost_scsi_ctx *vc, 
		/* virtio-scsi spec requires byte 0 of the lun to be 1 */

		vq_err(vq, "Illegal virtio-scsi lun: %u\n", *vc->lunp);

	} else {

		struct vhost_scsi_tpg **vs_tpg, *tpg;



		vs_tpg = vhost_vq_get_backend(vq);	/* validated at handler entry */

		struct vhost_scsi_tpg **vs_tpg, *tpg = NULL;



		if (vc->target) {

			/* validated at handler entry */

			vs_tpg = vhost_vq_get_backend(vq);

			tpg = READ_ONCE(vs_tpg[*vc->target]);

			if (unlikely(!tpg)) {

				vq_err(vq, "Target 0x%x does not exist\n", *vc->target);

		} else {

				goto out;

			}

		}



		if (tpgp)

			*tpgp = tpg;

		ret = 0;

	}

	}



out:

	return ret;

}