Commit 882d4171 authored Jan 02, 2018 by Bart Van Assche Committed by Jens Axboe Jan 05, 2018

pktcdvd: Fix a recently introduced NULL pointer dereference



Call bdev_get_queue(bdev) after bdev->bd_disk has been initialized
instead of just before that pointer has been initialized. This patch
avoids that the following command

pktsetup 1 /dev/sr0

triggers the following kernel crash:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000548
IP: pkt_setup_dev+0x2db/0x670 [pktcdvd]
CPU: 2 PID: 724 Comm: pktsetup Not tainted 4.15.0-rc4-dbg+ #1
Call Trace:
 pkt_ctl_ioctl+0xce/0x1c0 [pktcdvd]
 do_vfs_ioctl+0x8e/0x670
 SyS_ioctl+0x3c/0x70
 entry_SYSCALL_64_fastpath+0x23/0x9a

Reported-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Fixes: commit ca18d6f7 ("block: Make most scsi_req_init() calls implicit")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Tested-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Cc: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Cc: <stable@vger.kernel.org> # v4.13
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent 5a0ec388

drivers/block/pktcdvd.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -2579,14 +2579,14 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
		bdev = bdget(dev);
		if (!bdev)
		return -ENOMEM;
		ret = blkdev_get(bdev, FMODE_READ \| FMODE_NDELAY, NULL);
		if (ret)
		return ret;
		if (!blk_queue_scsi_passthrough(bdev_get_queue(bdev))) {
		WARN_ONCE(true, "Attempt to register a non-SCSI queue\n");
		bdput(bdev);
		blkdev_put(bdev, FMODE_READ \| FMODE_NDELAY);
		return -EINVAL;
		}
		ret = blkdev_get(bdev, FMODE_READ \| FMODE_NDELAY, NULL);
		if (ret)
		return ret;

		/* This is safe, since we have a reference from open(). */
		__module_get(THIS_MODULE);

Admin message