Re: Re: [PATCH] sata_dwc_460ex: Fix missing check in sata_dwc_isr

[dinghao . liu]

> On Mon, Mar 1, 2021 at 9:44 AM Dinghao Liu <dinghao.liu@xxxxxxxxxx> wrote:
> >
> > ata_qc_from_tag() may return a null pointer and further lead to
> > null-pointer-dereference. Add a return value check to avoid such case.
> 
> Can you elaborate more on this? Is it a real case?
> I have a hardware, how can I reproduce this?
> 

In the branch 'if (intpr & SATA_DWC_INTPR_NEWFP)', we call ata_qc_from_tag()
and access qc->ap->link.active_tag immediately. If ata_qc_from_tag() returns
a null pointer, accessing qc->ap->link.active_tag may crash the system.

This issue is reported by my static analysis tool, so I don't have the
vulnerable input currently.

Regards,
Dinghao