• Damien Le Moal's avatar
    ata: libata-scsi: Fix ata_msense_control_spgt2() · 03a9cfc1
    Damien Le Moal authored
    ata_msense_control_spgt2() can be called even for devices that do not
    support CDL when the user requests the ALL_SUB_MPAGES mode sense page,
    but for such device, this will cause a NULL pointer dereference as
    dev->cdl is NULL. Similarly, we should not return any data if
    ata_msense_control_spgt2() is called when the user requested the
    CDL_T2A_SUB_MPAGE or CDL_T2B_SUB_MPAGE pages for a device that does not
    support CDL.
    
    Avoid this potential NULL pointer dereference by checking if the device
    support CDL on entry to ata_msense_control_spgt2() and return 0 if it
    does not support CDL.
    
    Reported-by: syzbot+37757dc11ee77ef850bb@syzkaller.appspotmail.com
    Tested-by: syzbot+37757dc11ee77ef850bb@syzkaller.appspotmail.com
    Fixes: 602bcf21 ("ata: libata: Improve CDL resource management")
    Signed-off-by: default avatarDamien Le Moal <dlemoal@kernel.org>
    Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
    03a9cfc1
libata-scsi.c 119 KB