Re: Re: [PATCH] sata_dwc_460ex: Fix missing check in sata_dwc_isr

On Mon, Mar 1, 2021 at 9:44 AM Dinghao Liu [off-list ref] wrote:

quoted

ata_qc_from_tag() may return a null pointer and further lead to
null-pointer-dereference. Add a return value check to avoid such case.

Can you elaborate more on this? Is it a real case?
I have a hardware, how can I reproduce this?

In the branch 'if (intpr & SATA_DWC_INTPR_NEWFP)', we call ata_qc_from_tag()
and access qc->ap->link.active_tag immediately. If ata_qc_from_tag() returns
a null pointer, accessing qc->ap->link.active_tag may crash the system.

This issue is reported by my static analysis tool, so I don't have the
vulnerable input currently.

Regards,
Dinghao