From owner-freebsd-bugs@FreeBSD.ORG Mon Sep 8 12:30:22 2003 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 57FD016A4BF for ; Mon, 8 Sep 2003 12:30:22 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1900044001 for ; Mon, 8 Sep 2003 12:30:18 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id h88JUHUp009445 for ; Mon, 8 Sep 2003 12:30:17 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.9/8.12.9/Submit) id h88JUHaC009444; Mon, 8 Sep 2003 12:30:17 -0700 (PDT) Resent-Date: Mon, 8 Sep 2003 12:30:17 -0700 (PDT) Resent-Message-Id: <200309081930.h88JUHaC009444@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Jeff Fellin Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7CEE716A4BF for ; Mon, 8 Sep 2003 12:26:52 -0700 (PDT) Received: from crufty.research.bell-labs.com (crufty.research.bell-labs.com [204.178.16.49]) by mx1.FreeBSD.org (Postfix) with ESMTP id D9E8643FF9 for ; Mon, 8 Sep 2003 12:26:50 -0700 (PDT) (envelope-from jkf@research.bell-labs.com) Received: from scummy.research.bell-labs.com (H-135-104-2-10.research.bell-labs.com [135.104.2.10])h88JQn9Y012501 for ; Mon, 8 Sep 2003 15:26:49 -0400 (EDT) Received: from nslocum.cs.bell-labs.com (nslocum.cs.bell-labs.com [135.104.8.38])h88JQg2e075785 for ; Mon, 8 Sep 2003 15:26:42 -0400 (EDT) Received: from nslocum.cs.bell-labs.com (localhost [127.0.0.1]) h88JQgHd53365186 for ; Mon, 8 Sep 2003 15:26:42 -0400 (EDT) Received: (from jkf@localhost)h88JQgjs45426475 for FreeBSD-gnats-submit@freebsd.org; Mon, 8 Sep 2003 15:26:42 -0400 (EDT) Message-Id: <200309081926.h88JQgjs45426475@nslocum.cs.bell-labs.com> Date: Mon, 8 Sep 2003 15:26:42 -0400 (EDT) From: Jeff Fellin To: FreeBSD-gnats-submit@FreeBSD.org Subject: kern/56605: da driver can reference a NULL pointer X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Sep 2003 19:30:22 -0000 >Number: 56605 >Category: kern >Synopsis: da driver can reference a NULL pointer >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Sep 08 12:30:17 PDT 2003 >Closed-Date: >Last-Modified: >Originator: Jeff Fellin >Release: FreeBSD current i386 >Organization: Bell Labs >Environment: System: FreeBSD nstg6.cs.bell-labs.com 4.4-STABLE FreeBSD 4.4-STABLE #0: Tue Oct 22 10:15:48 EDT 2002 jkf@nstg6.research.bell-labs.com:/bsd.stable/src/sys/compi le/DEV.UP i386 >Description: the routine daopen() in sys/cam/scsi can reference a NULL pointer. Lines 457-463: s = splsoftcam(); periph = (struct cam_periph *)dp->d_drv1; unit = periph->unit_number; /* POSSIBLE NULL REFERENCE */ if (periph == NULL) { splx(s); return (ENXIO); } >How-To-Repeat: Code inspection, no test. >Fix: Move line 459 to be after line 463 as follows Lines 457-463: s = splsoftcam(); periph = (struct cam_periph *)dp->d_drv1; if (periph == NULL) { splx(s); return (ENXIO); } unit = periph->unit_number; ~ >Release-Note: >Audit-Trail: >Unformatted: I sent the following report via send-pr, but I don't think it left the free BSD machine I ran the command on. Jeff Fellin Room 2C-423 Bell-Labs, Murray Hill (908) 582-7673 fellin@lucent.com