Skip to content

Commit 9fdb273

Browse files
Alexandra Diupinagregkh
authored andcommitted
scsi: 53c700: Check that command slot is not NULL
commit 8366d1f upstream. Add a check for the command slot value to avoid dereferencing a NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e ("Linux-2.6.12-rc2") Co-developed-by: Vladimir Telezhnikov <vtelezhnikov@astralinux.ru> Signed-off-by: Vladimir Telezhnikov <vtelezhnikov@astralinux.ru> Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru> Link: https://lore.kernel.org/r/20230728123521.18293-1-adiupina@astralinux.ru Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 8282d0b commit 9fdb273

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/scsi/53c700.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1598,7 +1598,7 @@ NCR_700_intr(int irq, void *dev_id)
15981598
printk("scsi%d (%d:%d) PHASE MISMATCH IN SEND MESSAGE %d remain, return %p[%04x], phase %s\n", host->host_no, pun, lun, count, (void *)temp, temp - hostdata->pScript, sbcl_to_string(NCR_700_readb(host, SBCL_REG)));
15991599
#endif
16001600
resume_offset = hostdata->pScript + Ent_SendMessagePhaseMismatch;
1601-
} else if(dsp >= to32bit(&slot->pSG[0].ins) &&
1601+
} else if (slot && dsp >= to32bit(&slot->pSG[0].ins) &&
16021602
dsp <= to32bit(&slot->pSG[NCR_700_SG_SEGMENTS].ins)) {
16031603
int data_transfer = NCR_700_readl(host, DBC_REG) & 0xffffff;
16041604
int SGcount = (dsp - to32bit(&slot->pSG[0].ins))/sizeof(struct NCR_700_SG_List);

0 commit comments

Comments
 (0)