From jkf@research.bell-labs.com Mon Sep 8 12:26:52 2003 Return-Path: Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7CEE716A4BF for ; Mon, 8 Sep 2003 12:26:52 -0700 (PDT) Received: from crufty.research.bell-labs.com (crufty.research.bell-labs.com [204.178.16.49]) by mx1.FreeBSD.org (Postfix) with ESMTP id D9E8643FF9 for ; Mon, 8 Sep 2003 12:26:50 -0700 (PDT) (envelope-from jkf@research.bell-labs.com) Received: from scummy.research.bell-labs.com (H-135-104-2-10.research.bell-labs.com [135.104.2.10]) by crufty.research.bell-labs.com (8.12.9/8.12.9) with ESMTP id h88JQn9Y012501 for ; Mon, 8 Sep 2003 15:26:49 -0400 (EDT) Received: from nslocum.cs.bell-labs.com (nslocum.cs.bell-labs.com [135.104.8.38]) by scummy.research.bell-labs.com (8.12.9/8.12.9) with ESMTP id h88JQg2e075785 for ; Mon, 8 Sep 2003 15:26:42 -0400 (EDT) Received: from nslocum.cs.bell-labs.com (localhost [127.0.0.1]) by nslocum.cs.bell-labs.com (8.12.9/8.12.9) with ESMTP id h88JQgHd53365186 for ; Mon, 8 Sep 2003 15:26:42 -0400 (EDT) Received: (from jkf@localhost) by nslocum.cs.bell-labs.com (8.12.9/8.12.9/Submit) id h88JQgjs45426475 for FreeBSD-gnats-submit@freebsd.org; Mon, 8 Sep 2003 15:26:42 -0400 (EDT) Message-Id: <200309081926.h88JQgjs45426475@nslocum.cs.bell-labs.com> Date: Mon, 8 Sep 2003 15:26:42 -0400 (EDT) From: Jeff Fellin To: FreeBSD-gnats-submit@freebsd.org Subject: da driver can reference a NULL pointer >Number: 56605 >Category: kern >Synopsis: da driver can reference a NULL pointer >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: closed >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Sep 08 12:30:17 PDT 2003 >Closed-Date: Sun Jun 20 23:04:20 GMT 2004 >Last-Modified: Sun Jun 20 23:04:20 GMT 2004 >Originator: Jeff Fellin >Release: FreeBSD current i386 >Organization: Bell Labs >Environment: System: FreeBSD nstg6.cs.bell-labs.com 4.4-STABLE FreeBSD 4.4-STABLE #0: Tue Oct 22 10:15:48 EDT 2002 jkf@nstg6.research.bell-labs.com:/bsd.stable/src/sys/compi le/DEV.UP i386 >Description: the routine daopen() in sys/cam/scsi can reference a NULL pointer. Lines 457-463: s = splsoftcam(); periph = (struct cam_periph *)dp->d_drv1; unit = periph->unit_number; /* POSSIBLE NULL REFERENCE */ if (periph == NULL) { splx(s); return (ENXIO); } >How-To-Repeat: Code inspection, no test. >Fix: Move line 459 to be after line 463 as follows Lines 457-463: s = splsoftcam(); periph = (struct cam_periph *)dp->d_drv1; if (periph == NULL) { splx(s); return (ENXIO); } unit = periph->unit_number; ~ >Release-Note: >Audit-Trail: State-Changed-From-To: open->closed State-Changed-By: le State-Changed-When: Sun Jun 20 23:03:54 GMT 2004 State-Changed-Why: This was fixed in rev. 1.164 of sys/cam/scsi/scsi_da.c. http://www.freebsd.org/cgi/query-pr.cgi?pr=56605 >Unformatted: I sent the following report via send-pr, but I don't think it left the free BSD machine I ran the command on. Jeff Fellin Room 2C-423 Bell-Labs, Murray Hill (908) 582-7673 fellin@lucent.com