Re: [PATCH] scsi: ufs: core: fix NULL deref in remaining scsi_cmd_priv() callers

[Bart Van Assche]

On 10/26/26 1:47 AM, shao.mingyin@xxxxxxxxxx wrote:
> From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
>
> Commit 4cf752f6b99a ("scsi: ufs: core: Fix NULL pointer dereference in
> scsi_cmd_priv() calls") fixed the callers that dereference the command
> pointer returned by ufshcd_tag_to_cmd() via scsi_cmd_priv() without
> checking for NULL first, but three call sites with the same pattern were
> left:
>
> - ufshcd_compl_one_cqe(): scsi_cmd_priv(cmd) runs before the !cmd check.
> - ufshcd_mcq_sq_cleanup(): scsi_cmd_priv(cmd) and scsi_cmd_to_rq(cmd)
>    run before the !cmd check.
> - ufshcd_issue_devman_upiu_cmd(): scsi_cmd_priv(cmd) runs before the
>    WARN_ON_ONCE(!cmd) check.
>
> Fix these three remaining sites by deferring the pointer arithmetic until
> after the NULL check.

In the Linux kernel, passing NULL to container_of() is safe if the
result of container_of() is not used. The code modified by this patch
does not use the result of container_of() before checking that the 
pointer passed to container_of() is not NULL. In other words, this patch
doesn't fix any bugs.

Bart.