d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix potential NULL pointer dereference of device physical path

Browse Source 
In scsi_dev_advinfo(), if the physical path is being stored and there is a
malloc failure (malloc(9) is called with M_NOWAIT), we could wind up in a
situation where the device's physpath_len is set to the length the user
provided, but the physpath itself is NULL.

If another context then comes in to fetch the physical path value, we would
wind up trying to memcpy a NULL pointer into the caller's buffer.

So, set the physpath_len to 0 when we free the physpath on entry into the
store case for the physical path.  Reset the length to a non-zero value only
after we've successfully malloced a buffer to hold it.

Submitted by:	ken
Reviewed by:	asomers
MFC after:	3 weeks
Sponsored by:	Spectra Logic Corp
This commit is contained in:
asomers 2017-11-17 17:13:00 +00:00
parent 673fc38903
commit fe0223fae5
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/cam/scsi/scsi_xpt.c
View File

@ -2549,8 +2549,8 @@ scsi_dev_advinfo(union ccb *start_ccb)
if (device->physpath != NULL) {
free(device->physpath, M_CAMXPT);
device->physpath = NULL;
device->physpath_len = 0;
}
device->physpath_len = cdai->bufsiz;
/* Clear existing buffer if zero length */
if (cdai->bufsiz == 0)
break;
@ -2559,6 +2559,7 @@ scsi_dev_advinfo(union ccb *start_ccb)
start_ccb->ccb_h.status = CAM_REQ_ABORTED;
return;
}
device->physpath_len = cdai->bufsiz;
memcpy(device->physpath, cdai->buf, cdai->bufsiz);
} else {
cdai->provsiz = device->physpath_len;