• Varun Prakash's avatar
    scsi: libiscsi: fix possible NULL pointer dereference in case of TMF · a17037e7
    Varun Prakash authored
    In iscsi_check_tmf_restrictions() task->hdr is dereferenced to print the
    opcode, it is possible that task->hdr is NULL.
    
    There are two cases based on opcode argument:
    
    1. ISCSI_OP_SCSI_CMD - In this case alloc_pdu() is called
    after iscsi_check_tmf_restrictions()
    
    iscsi_prep_scsi_cmd_pdu() -> iscsi_check_tmf_restrictions() -> alloc_pdu().
    
    Transport drivers allocate memory for iSCSI hdr in alloc_pdu() and assign
    it to task->hdr. In case of TMF task->hdr will be NULL resulting in NULL
    pointer dereference.
    
    2. ISCSI_OP_SCSI_DATA_OUT - In this case transport driver can free the
    memory for iSCSI hdr after transmitting the pdu so task->hdr can be NULL or
    invalid.
    
    This patch fixes this issue by removing task->hdr->opcode from the printk
    statement.
    Signed-off-by: default avatarVarun Prakash <varun@chelsio.com>
    Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
    a17037e7
libiscsi.c 98 KB