| Message ID | 20180115041648.33740-1-linzhecheng@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | scsi: handle the special parameters | expand |
On 15/01/2018 05:16, linzhecheng wrote: > scsi_disk_emulate_command calls > scsi_build_sense(NULL, 0, outbuf, r->buflen, > (req->cmd.buf[1] & 1) == 0); > But scsi_convert_sense doesn't handle the case when in_buf is NULL > or in_len is 0, which will lead to segfault. > This is already fixed in my last pull request. Paolo > Signed-off-by: linzhecheng <linzhecheng@huawei.com> > --- > scsi/utils.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/scsi/utils.c b/scsi/utils.c > index ddae650a99..b769e80c12 100644 > --- a/scsi/utils.c > +++ b/scsi/utils.c > @@ -322,6 +322,10 @@ int scsi_convert_sense(uint8_t *in_buf, int in_len, > SCSISense sense; > bool fixed_in; > > + if (!in_buf || !in_len) { > + return 0; > + } > + > fixed_in = (in_buf[0] & 2) == 0; > if (in_len && fixed == fixed_in) { > memcpy(buf, in_buf, MIN(len, in_len)); >
diff --git a/scsi/utils.c b/scsi/utils.c index ddae650a99..b769e80c12 100644 --- a/scsi/utils.c +++ b/scsi/utils.c @@ -322,6 +322,10 @@ int scsi_convert_sense(uint8_t *in_buf, int in_len, SCSISense sense; bool fixed_in; + if (!in_buf || !in_len) { + return 0; + } + fixed_in = (in_buf[0] & 2) == 0; if (in_len && fixed == fixed_in) { memcpy(buf, in_buf, MIN(len, in_len));
scsi_disk_emulate_command calls scsi_build_sense(NULL, 0, outbuf, r->buflen, (req->cmd.buf[1] & 1) == 0); But scsi_convert_sense doesn't handle the case when in_buf is NULL or in_len is 0, which will lead to segfault. Signed-off-by: linzhecheng <linzhecheng@huawei.com> --- scsi/utils.c | 4 ++++ 1 file changed, 4 insertions(+)