Date: Mon, 31 Aug 2009 10:44:01 GMT From: Patroklos Argyroudis <argp@census-labs.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/138384: NULL pointer dereference in ipsd_dump() in file sys/dev/ips/ips_disk.c Message-ID: <200908311044.n7VAi1Ll088241@www.freebsd.org> Resent-Message-ID: <200908311050.n7VAoAjn050504@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 138384
>Category: kern
>Synopsis: NULL pointer dereference in ipsd_dump() in file sys/dev/ips/ips_disk.c
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Aug 31 10:50:10 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Patroklos Argyroudis
>Release: 8.0-CURRENT
>Organization:
census, inc
>Environment:
N/A
>Description:
There is a NULL pointer dereference in ipsd_dump() in file sys/dev/ips/ips_disk.c line 195. The check against NULL in line 197 should be before the dereference of dsc.
>How-To-Repeat:
N/A
>Fix:
Patch attached.
Patch attached with submission follows:
--- ./sys/dev/ips/ips_disk.c.orig 2009-08-28 16:01:13.000000000 +0300
+++ ./sys/dev/ips/ips_disk.c 2009-08-28 16:03:38.000000000 +0300
@@ -192,11 +192,12 @@
dp = arg;
dsc = dp->d_drv1;
- sc = dsc->sc;
if (dsc == NULL)
return (EINVAL);
+ sc = dsc->sc;
+
if (ips_get_free_cmd(sc, &command, 0) != 0) {
printf("ipsd: failed to get cmd for dump\n");
return (ENOMEM);
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200908311044.n7VAi1Ll088241>