Maurizio Lombardi 55dfffc5e9 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() ... [ Upstream commit d8ab68bdb2 ] The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Meneghini <jmeneghi@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-07-10 16:03:16 +02:00
..
iscsi
loopback
sbp
tcm_fc
tcm_remote
Kconfig
Makefile
target_core_alua.c
target_core_alua.h
target_core_configfs.c
target_core_device.c
target_core_fabric_configfs.c
target_core_fabric_lib.c
target_core_file.c
target_core_file.h
target_core_hba.c
target_core_iblock.c
target_core_iblock.h
target_core_internal.h
target_core_pr.c	scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()	2025-07-10 16:03:16 +02:00
target_core_pr.h
target_core_pscsi.c
target_core_pscsi.h
target_core_rd.c
target_core_rd.h
target_core_sbc.c
target_core_spc.c	scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()	2025-06-04 14:42:10 +02:00
target_core_stat.c
target_core_tmr.c
target_core_tpg.c
target_core_transport.c
target_core_ua.c
target_core_ua.h
target_core_user.c
target_core_xcopy.c
target_core_xcopy.h