From: Jason Yan <yanaijie@huawei.com> To: <martin.petersen@oracle.com>, <jejb@linux.vnet.ibm.com> Cc: <linux-scsi@vger.kernel.org>, <linux-kernel@vger.kernel.org>, <john.garry@huawei.com>, <zhaohongjiang@huawei.com>, <hare@suse.com>, <dan.j.williams@intel.com>, <jthumshirn@suse.de>, <hch@lst.de>, <huangdaode@hisilicon.com>, <chenxiang66@hisilicon.com>, <miaoxie@huawei.com>, Jason Yan <yanaijie@huawei.com>, Ewan Milne <emilne@redhat.com>, Tomas Henzl <thenzl@redhat.com> Subject: [PATCH v2 5/5] scsi: libsas: fix a race condition when smp task timeout Date: Wed, 19 Sep 2018 11:32:04 +0800 [thread overview] Message-ID: <20180919033204.11102-6-yanaijie@huawei.com> (raw) In-Reply-To: <20180919033204.11102-1-yanaijie@huawei.com> When the lldd is processing the complete sas task in interrupt and set the task stat as SAS_TASK_STATE_DONE, the smp timeout timer is able to be triggered at the same time. And smp_task_timedout() will complete the task wheter the SAS_TASK_STATE_DONE is set or not. Then the sas task may freed before lldd end the interrupt process. Thus a use-after-free will happen. Fix this by calling the complete() only when SAS_TASK_STATE_DONE is not set. And remove the check of the return value of the del_timer(). Once the LLDD sets DONE, it must call task->done(), which will call smp_task_done()->complete() and the task will be completed and freed correctly. Reported-by: chenxiang <chenxiang66@hisilicon.com> Signed-off-by: Jason Yan <yanaijie@huawei.com> CC: John Garry <john.garry@huawei.com> CC: Johannes Thumshirn <jthumshirn@suse.de> CC: Ewan Milne <emilne@redhat.com> CC: Christoph Hellwig <hch@lst.de> CC: Tomas Henzl <thenzl@redhat.com> CC: Dan Williams <dan.j.williams@intel.com> CC: Hannes Reinecke <hare@suse.com> Reviewed-by: Hannes Reinecke <hare@suse.com> --- drivers/scsi/libsas/sas_expander.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c index 52222940d398..0d1f72752ca2 100644 --- a/drivers/scsi/libsas/sas_expander.c +++ b/drivers/scsi/libsas/sas_expander.c @@ -48,17 +48,16 @@ static void smp_task_timedout(struct timer_list *t) unsigned long flags; spin_lock_irqsave(&task->task_state_lock, flags); - if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) + if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { task->task_state_flags |= SAS_TASK_STATE_ABORTED; + complete(&task->slow_task->completion); + } spin_unlock_irqrestore(&task->task_state_lock, flags); - - complete(&task->slow_task->completion); } static void smp_task_done(struct sas_task *task) { - if (!del_timer(&task->slow_task->timer)) - return; + del_timer(&task->slow_task->timer); complete(&task->slow_task->completion); } -- 2.14.4
WARNING: multiple messages have this Message-ID (diff)
From: Jason Yan <yanaijie@huawei.com> To: martin.petersen@oracle.com, jejb@linux.vnet.ibm.com Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, john.garry@huawei.com, zhaohongjiang@huawei.com, hare@suse.com, dan.j.williams@intel.com, jthumshirn@suse.de, hch@lst.de, huangdaode@hisilicon.com, chenxiang66@hisilicon.com, miaoxie@huawei.com, Jason Yan <yanaijie@huawei.com>, Ewan Milne <emilne@redhat.com>, Tomas Henzl <thenzl@redhat.com> Subject: [PATCH v2 5/5] scsi: libsas: fix a race condition when smp task timeout Date: Wed, 19 Sep 2018 11:32:04 +0800 [thread overview] Message-ID: <20180919033204.11102-6-yanaijie@huawei.com> (raw) In-Reply-To: <20180919033204.11102-1-yanaijie@huawei.com> When the lldd is processing the complete sas task in interrupt and set the task stat as SAS_TASK_STATE_DONE, the smp timeout timer is able to be triggered at the same time. And smp_task_timedout() will complete the task wheter the SAS_TASK_STATE_DONE is set or not. Then the sas task may freed before lldd end the interrupt process. Thus a use-after-free will happen. Fix this by calling the complete() only when SAS_TASK_STATE_DONE is not set. And remove the check of the return value of the del_timer(). Once the LLDD sets DONE, it must call task->done(), which will call smp_task_done()->complete() and the task will be completed and freed correctly. Reported-by: chenxiang <chenxiang66@hisilicon.com> Signed-off-by: Jason Yan <yanaijie@huawei.com> CC: John Garry <john.garry@huawei.com> CC: Johannes Thumshirn <jthumshirn@suse.de> CC: Ewan Milne <emilne@redhat.com> CC: Christoph Hellwig <hch@lst.de> CC: Tomas Henzl <thenzl@redhat.com> CC: Dan Williams <dan.j.williams@intel.com> CC: Hannes Reinecke <hare@suse.com> Reviewed-by: Hannes Reinecke <hare@suse.com> --- drivers/scsi/libsas/sas_expander.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c index 52222940d398..0d1f72752ca2 100644 --- a/drivers/scsi/libsas/sas_expander.c +++ b/drivers/scsi/libsas/sas_expander.c @@ -48,17 +48,16 @@ static void smp_task_timedout(struct timer_list *t) unsigned long flags; spin_lock_irqsave(&task->task_state_lock, flags); - if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) + if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { task->task_state_flags |= SAS_TASK_STATE_ABORTED; + complete(&task->slow_task->completion); + } spin_unlock_irqrestore(&task->task_state_lock, flags); - - complete(&task->slow_task->completion); } static void smp_task_done(struct sas_task *task) { - if (!del_timer(&task->slow_task->timer)) - return; + del_timer(&task->slow_task->timer); complete(&task->slow_task->completion); } -- 2.14.4
next prev parent reply other threads:[~2018-09-19 3:33 UTC|newest] Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-09-19 3:31 [PATCH v2 0/5] scsi: libsas: some code cleanups and bug fixes Jason Yan 2018-09-19 3:31 ` Jason Yan 2018-09-19 3:32 ` [PATCH v2 1/5] scsi: libsas: delete dead code in scsi_transport_sas.c Jason Yan 2018-09-19 3:32 ` Jason Yan 2018-09-19 14:54 ` Johannes Thumshirn 2018-09-20 6:32 ` Christoph Hellwig 2018-09-19 3:32 ` [PATCH v2 2/5] scsi: libsas: check the lldd callback correctly Jason Yan 2018-09-19 3:32 ` Jason Yan 2018-09-19 14:56 ` Johannes Thumshirn 2018-09-20 6:34 ` Christoph Hellwig 2018-09-19 3:32 ` [PATCH v2 3/5] scsi: libsas: always unregister the old device if going to discover new Jason Yan 2018-09-19 3:32 ` Jason Yan 2018-09-19 3:32 ` [PATCH v2 4/5] scsi: libsas: check the ata device status by ata_dev_enabled() Jason Yan 2018-09-19 3:32 ` Jason Yan 2018-09-19 14:57 ` Johannes Thumshirn 2018-09-20 6:34 ` Christoph Hellwig 2018-09-19 3:32 ` Jason Yan [this message] 2018-09-19 3:32 ` [PATCH v2 5/5] scsi: libsas: fix a race condition when smp task timeout Jason Yan 2018-09-19 8:42 ` John Garry 2018-09-19 8:42 ` John Garry 2018-09-19 14:57 ` Johannes Thumshirn
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180919033204.11102-6-yanaijie@huawei.com \ --to=yanaijie@huawei.com \ --cc=chenxiang66@hisilicon.com \ --cc=dan.j.williams@intel.com \ --cc=emilne@redhat.com \ --cc=hare@suse.com \ --cc=hch@lst.de \ --cc=huangdaode@hisilicon.com \ --cc=jejb@linux.vnet.ibm.com \ --cc=john.garry@huawei.com \ --cc=jthumshirn@suse.de \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-scsi@vger.kernel.org \ --cc=martin.petersen@oracle.com \ --cc=miaoxie@huawei.com \ --cc=thenzl@redhat.com \ --cc=zhaohongjiang@huawei.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.