From jkf@research.bell-labs.com  Mon Sep  8 12:26:52 2003
Return-Path: <jkf@research.bell-labs.com>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7CEE716A4BF
	for <FreeBSD-gnats-submit@freebsd.org>; Mon,  8 Sep 2003 12:26:52 -0700 (PDT)
Received: from crufty.research.bell-labs.com (crufty.research.bell-labs.com [204.178.16.49])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D9E8643FF9
	for <FreeBSD-gnats-submit@freebsd.org>; Mon,  8 Sep 2003 12:26:50 -0700 (PDT)
	(envelope-from jkf@research.bell-labs.com)
Received: from scummy.research.bell-labs.com (H-135-104-2-10.research.bell-labs.com [135.104.2.10])
	by crufty.research.bell-labs.com (8.12.9/8.12.9) with ESMTP id h88JQn9Y012501
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 8 Sep 2003 15:26:49 -0400 (EDT)
Received: from nslocum.cs.bell-labs.com (nslocum.cs.bell-labs.com [135.104.8.38])
	by scummy.research.bell-labs.com (8.12.9/8.12.9) with ESMTP id h88JQg2e075785
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 8 Sep 2003 15:26:42 -0400 (EDT)
Received: from nslocum.cs.bell-labs.com (localhost [127.0.0.1])
	by nslocum.cs.bell-labs.com (8.12.9/8.12.9) with ESMTP id h88JQgHd53365186
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 8 Sep 2003 15:26:42 -0400 (EDT)
Received: (from jkf@localhost)
	by nslocum.cs.bell-labs.com (8.12.9/8.12.9/Submit) id h88JQgjs45426475
	for FreeBSD-gnats-submit@freebsd.org; Mon, 8 Sep 2003 15:26:42 -0400 (EDT)
Message-Id: <200309081926.h88JQgjs45426475@nslocum.cs.bell-labs.com>
Date: Mon, 8 Sep 2003 15:26:42 -0400 (EDT)
From: Jeff Fellin <jkf@research.bell-labs.com>
To: FreeBSD-gnats-submit@freebsd.org
Subject: da driver can reference a NULL pointer

>Number:         56605
>Category:       kern
>Synopsis:       da driver can reference a NULL pointer
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Sep 08 12:30:17 PDT 2003
>Closed-Date:    Sun Jun 20 23:04:20 GMT 2004
>Last-Modified:  Sun Jun 20 23:04:20 GMT 2004
>Originator:     Jeff Fellin
>Release:        FreeBSD current i386
>Organization:
Bell Labs
>Environment:
System: FreeBSD nstg6.cs.bell-labs.com 4.4-STABLE FreeBSD 4.4-STABLE #0: Tue Oct
 22 10:15:48 EDT 2002 jkf@nstg6.research.bell-labs.com:/bsd.stable/src/sys/compi
le/DEV.UP i386


>Description:
        the routine daopen() in sys/cam/scsi can reference a NULL pointer.
        Lines 457-463:
                s = splsoftcam();
                periph = (struct cam_periph *)dp->d_drv1;
                unit = periph->unit_number;     /* POSSIBLE NULL REFERENCE */
                if (periph == NULL) {
                        splx(s);
                        return (ENXIO);
                }
>How-To-Repeat:
        Code inspection, no test. 
>Fix:
        Move line 459 to be after line 463 as follows
        Lines 457-463:
                s = splsoftcam();
                periph = (struct cam_periph *)dp->d_drv1;
                if (periph == NULL) {
                        splx(s);
                        return (ENXIO);
                }
                unit = periph->unit_number;     
~
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: le 
State-Changed-When: Sun Jun 20 23:03:54 GMT 2004 
State-Changed-Why:  
This was fixed in rev. 1.164 of sys/cam/scsi/scsi_da.c. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=56605 
>Unformatted:
 I sent the following report via send-pr, but I don't think it left the
 free BSD machine I ran the command on.
 
 	Jeff Fellin
 	Room 2C-423
 	Bell-Labs, Murray Hill
 	(908) 582-7673
 	fellin@lucent.com
 
