DF-2524
trm_Disconnect dereferences pDCB->pActiveSRB without NULL check kernel panic on spurious disconnect (acknowledged in source)
Summary
trm_Disconnect fetches pSRB=pDCB->pActiveSRB and immediately dereferences pSRB->pccb. Author left literal comment bug pSRB=0 at :2355 acknowledging unguarded dereference. DISCONNECT or selection-timeout interrupt arriving without prior successful selection (pActiveSRB would have been set by trm_StartSCSI) NULL-dereferences panics kernel. pActiveSRB only assigned in trm_StartSCSI:1287 and trm_Reselect cleared to NULL in trm_Disconnect:2402 after SRB_COMPLETED. Malicious/misbehaving SCSI device can trigger spurious DISCONNECT/SELTIMEOUT.
No comments yet.