Re: [PATCH] esp: process the result of scsi_device_find()

[Mark Cave-Ayland]

On 26/12/2023 12:08, Philippe Mathieu-Daudé wrote:

> Cc'ing Mark for the logical change (should we rather assert?).
>
> On 18/12/23 16:02, Alexandra Diupina wrote:
> > Add a 'current_lun' check for a null value
> > to avoid null pointer dereferencing
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
> > Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
> > ---
> >   hw/scsi/esp.c | 5 +++++
> >   1 file changed, 5 insertions(+)
> >
> > diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
> > index 9b11d8c573..3a2ec35f9b 100644
> > --- a/hw/scsi/esp.c
> > +++ b/hw/scsi/esp.c
> > @@ -292,6 +292,11 @@ static void do_command_phase(ESPState *s)
> >       esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
> >       current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
> > +
> > +    if (!current_lun) {
> > +        return;
> > +    }
> > +
> >       s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
> >       datalen = scsi_req_enqueue(s->current_req);
> >       s->ti_size = datalen;

Checking for the NULL return from scsi_device_find() looks correct to me, but I don't 
think that a simple return will allow the host to recover. I suspect the right thing 
to do here is to duplicate the scsi_device_find() logic just above i.e. set the 
INTR_DC bit and then raise the IRQ if NULL is returned.


ATB,

Mark.