On 26/12/2023 12:08, Philippe Mathieu-Daudé wrote:
Cc'ing Mark for the logical change (should we rather assert?).
On 18/12/23 16:02, Alexandra Diupina wrote:
Add a 'current_lun' check for a null value
to avoid null pointer dereferencing
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
Signed-off-by: Alexandra Diupina <adiup...@astralinux.ru>
---
hw/scsi/esp.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 9b11d8c573..3a2ec35f9b 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -292,6 +292,11 @@ static void do_command_phase(ESPState *s)
esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
+
+ if (!current_lun) {
+ return;
+ }
+
s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
datalen = scsi_req_enqueue(s->current_req);
s->ti_size = datalen;
Checking for the NULL return from scsi_device_find() looks correct to me, but I don't
think that a simple return will allow the host to recover. I suspect the right thing
to do here is to duplicate the scsi_device_find() logic just above i.e. set the
INTR_DC bit and then raise the IRQ if NULL is returned.
ATB,
Mark.
