From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1C63C433E7 for ; Sun, 18 Oct 2020 19:24:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A150A207DE for ; Sun, 18 Oct 2020 19:24:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603049056; bh=/98Zb1vLk8D8gEKuqdCgRdpe9G2AWlck9qCBGmPL38k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=OEi/hiW44lroSiz268NH3nB5cMTgE/Y7mzdw0Nnd8p2uINL4kY4WkyqbOOEyuBloh cLyilg8hTndvDvrlkH4YVUH1CuZpg9ZTFRHVUoGW3gYDzXDP2gFFV/4dlBo6hCzCRG LMasL9qIWDsEcoGgp40M3r6U18YyfcucVDCoEZRg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728267AbgJRTYO (ORCPT ); Sun, 18 Oct 2020 15:24:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:37198 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728549AbgJRTXn (ORCPT ); Sun, 18 Oct 2020 15:23:43 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AC5A2222E9; Sun, 18 Oct 2020 19:23:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603049022; bh=/98Zb1vLk8D8gEKuqdCgRdpe9G2AWlck9qCBGmPL38k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GQQXgVhhwUdmumG+G8Xz5j9LCDh14C/kO5oLPq+94+A7mPw7Q3Yg2RUaaKdrLEYHq pkhcBpUXw1M+/WeyJ4vSdvjTEaT94e4GO2pqJn4BHILAf12IRJIU64jtg1SJh913wz G78SzQJ/OCeJJgT+0RuiS0Z7/70CJ3XDMTP2/ejg= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Daniel Wagner , Martin Wilck , Arun Easi , "Martin K . Petersen" , Sasha Levin , linux-scsi@vger.kernel.org Subject: [PATCH AUTOSEL 5.4 56/80] scsi: qla2xxx: Warn if done() or free() are called on an already freed srb Date: Sun, 18 Oct 2020 15:22:07 -0400 Message-Id: <20201018192231.4054535-56-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20201018192231.4054535-1-sashal@kernel.org> References: <20201018192231.4054535-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Daniel Wagner [ Upstream commit c0014f94218ea3a312f6235febea0d626c5f2154 ] Emit a warning when ->done or ->free are called on an already freed srb. There is a hidden use-after-free bug in the driver which corrupts the srb memory pool which originates from the cleanup callbacks. An extensive search didn't bring any lights on the real problem. The initial fix was to set both pointers to NULL and try to catch invalid accesses. But instead the memory corruption was gone and the driver didn't crash. Since not all calling places check for NULL pointer, add explicitly default handlers. With this we workaround the memory corruption and add a debug help. Link: https://lore.kernel.org/r/20200908081516.8561-2-dwagner@suse.de Reviewed-by: Martin Wilck Reviewed-by: Arun Easi Signed-off-by: Daniel Wagner Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/qla2xxx/qla_init.c | 10 ++++++++++ drivers/scsi/qla2xxx/qla_inline.h | 5 +++++ 2 files changed, 15 insertions(+) diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c index 62d2ee825c97a..b300e11095828 100644 --- a/drivers/scsi/qla2xxx/qla_init.c +++ b/drivers/scsi/qla2xxx/qla_init.c @@ -71,6 +71,16 @@ void qla2x00_sp_free(srb_t *sp) qla2x00_rel_sp(sp); } +void qla2xxx_rel_done_warning(srb_t *sp, int res) +{ + WARN_ONCE(1, "Calling done() of an already freed srb %p object\n", sp); +} + +void qla2xxx_rel_free_warning(srb_t *sp) +{ + WARN_ONCE(1, "Calling free() of an already freed srb %p object\n", sp); +} + /* Asynchronous Login/Logout Routines -------------------------------------- */ unsigned long diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h index 0c3d907af7692..6dfde42d799b5 100644 --- a/drivers/scsi/qla2xxx/qla_inline.h +++ b/drivers/scsi/qla2xxx/qla_inline.h @@ -183,10 +183,15 @@ qla2xxx_get_qpair_sp(scsi_qla_host_t *vha, struct qla_qpair *qpair, return sp; } +void qla2xxx_rel_done_warning(srb_t *sp, int res); +void qla2xxx_rel_free_warning(srb_t *sp); + static inline void qla2xxx_rel_qpair_sp(struct qla_qpair *qpair, srb_t *sp) { sp->qpair = NULL; + sp->done = qla2xxx_rel_done_warning; + sp->free = qla2xxx_rel_free_warning; mempool_free(sp, qpair->srb_mempool); QLA_QPAIR_MARK_NOT_BUSY(qpair); } -- 2.25.1