summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorAkinobu Mita <akinobu.mita@gmail.com>2013-06-29 17:59:16 +0900
committerJames Bottomley <JBottomley@Parallels.com>2013-07-09 09:23:04 +0100
commit7cb69d0397233546d82191e524235fdb9d1d91aa (patch)
treee0df6503fc02324d8606bc6bd63a9a6ec5258c31 /drivers
parentfc3fc352b6e7a6452596f8a13cedeaa6bcfe9689 (diff)
[SCSI] scsi_debug: fix NULL pointer dereference with parameters dif=0 dix=1
The protection info dif_storep is allocated only when parameter dif is not zero. But it will be accessed when reading or writing to the storage installed with parameter dix is not zero. So kernel crashes if scsi_debug module is loaded with parameters dix=1 and dif=0. This fixes it by making dif_storep available if parameter dix is not zero instead of checking if parameter dif is not zero. Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Acked-by: "Martin K. Petersen" <martin.petersen@oracle.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/scsi/scsi_debug.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index bcf73e44d2f..e83e661b025 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -3372,7 +3372,7 @@ static int __init scsi_debug_init(void)
if (scsi_debug_num_parts > 0)
sdebug_build_parts(fake_storep, sz);
- if (scsi_debug_dif) {
+ if (scsi_debug_dix) {
int dif_size;
dif_size = sdebug_store_sectors * sizeof(struct sd_dif_tuple);