Skip to content

Commit

Permalink
[SCSI] scsi_debug: fix NULL pointer dereference with parameters dif=0…
Browse files Browse the repository at this point in the history
… dix=1

The protection info dif_storep is allocated only when parameter dif is
not zero.  But it will be accessed when reading or writing to the storage
installed with parameter dix is not zero.

So kernel crashes if scsi_debug module is loaded with parameters dix=1 and
dif=0.

This fixes it by making dif_storep available if parameter dix is not zero
instead of checking if parameter dif is not zero.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: "Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
  • Loading branch information
Akinobu Mita authored and James Bottomley committed Jul 9, 2013
1 parent fc3fc35 commit 7cb69d0
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/scsi/scsi_debug.c
Original file line number Diff line number Diff line change
Expand Up @@ -3372,7 +3372,7 @@ static int __init scsi_debug_init(void)
if (scsi_debug_num_parts > 0)
sdebug_build_parts(fake_storep, sz);

if (scsi_debug_dif) {
if (scsi_debug_dix) {
int dif_size;

dif_size = sdebug_store_sectors * sizeof(struct sd_dif_tuple);
Expand Down

0 comments on commit 7cb69d0

Please sign in to comment.