Re: [PATCH] driver/ata: fix potential null pointer dereference on pointer last_sge

From: Damien Le Moal
Date: Tue Oct 26 2021 - 00:09:50 EST


On 2021/10/25 22:13, Chengfeng Ye wrote:
> The pointer cs_desc could be null if the loop is not
> executed, so there is a potential NULL-PTR dereference
> issue. Fix this by adding a null check before dereference.
>
> Signed-off-by: Chengfeng Ye <cyeaa@xxxxxxxxxxxxxx>
> ---
> drivers/ata/sata_sil24.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
> index 06a1e27c4f84..2bd595da799f 100644
> --- a/drivers/ata/sata_sil24.c
> +++ b/drivers/ata/sata_sil24.c
> @@ -785,6 +785,8 @@ static inline void sil24_fill_sg(struct ata_queued_cmd *qc,
> sge++;
> }
>
> + if (!last_sge)
> + return;
> last_sge->flags = cpu_to_le32(SGE_TRM);
> }

I do not think that this fix is necessary: sil24_fill_sg() is called only if the
qc has ATA_QCFLAG_DMAMAP set (see sil24_qc_prep()) and that in turn is only set
if ata_sg_setup() sees at least one sg entry. So the loop in sil24_fill_sg()
will always be executed for qc marked with ATA_QCFLAG_DMAMAP and so last_sg
cannot be NULL.

--
Damien Le Moal
Western Digital Research