* [Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed
@ 2022-04-19 14:28 Wenchao Hao
2022-04-19 14:56 ` Hannes Reinecke
0 siblings, 1 reply; 3+ messages in thread
From: Wenchao Hao @ 2022-04-19 14:28 UTC (permalink / raw)
To: Hannes Reinecke, James E.J. Bottomley, Martin K. Petersen,
linux-scsi, linux-kernel
Cc: Feilong Lin
Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd
if host reset failed. If host reset failed and eh_cmd_q of shost is not empty,
these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs()
and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related
request would be freed.
While since host reset failed, we can not guarantee the LLDDs has cleared all
references to these commands in eh_cmd_q. Is there any possibility that the
LLDDs reference to these commands? If this happened, then a using after free
issue would occur.
Waiting for your response.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed
2022-04-19 14:28 [Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed Wenchao Hao
@ 2022-04-19 14:56 ` Hannes Reinecke
2022-04-21 15:24 ` Wenchao Hao
0 siblings, 1 reply; 3+ messages in thread
From: Hannes Reinecke @ 2022-04-19 14:56 UTC (permalink / raw)
To: Wenchao Hao, James E.J. Bottomley, Martin K. Petersen,
linux-scsi, linux-kernel
Cc: Feilong Lin
On 4/19/22 16:28, Wenchao Hao wrote:
> Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd
> if host reset failed. If host reset failed and eh_cmd_q of shost is not empty,
> these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs()
> and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related
> request would be freed.
>
Yes.
> While since host reset failed, we can not guarantee the LLDDs has cleared all
> references to these commands in eh_cmd_q. Is there any possibility that the
> LLDDs reference to these commands? If this happened, then a using after free
> issue would occur.
>
If host reset has failed there are _no_ assumptions we can make about
commands, and not even about the PCI device itself.
So in effect, once host_reset failed the system is hosed.
We _might_ be able to resurrect the system by doing PCI EEH, but not
many systems nor drivers implement that.
Cheers,
Hannes
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed
2022-04-19 14:56 ` Hannes Reinecke
@ 2022-04-21 15:24 ` Wenchao Hao
0 siblings, 0 replies; 3+ messages in thread
From: Wenchao Hao @ 2022-04-21 15:24 UTC (permalink / raw)
To: Hannes Reinecke, James E.J. Bottomley, Martin K. Petersen,
linux-scsi, linux-kernel
Cc: Feilong Lin
On 2022/4/19 22:56, Hannes Reinecke wrote:
> On 4/19/22 16:28, Wenchao Hao wrote:
>> Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd
>> if host reset failed. If host reset failed and eh_cmd_q of shost is not empty,
>> these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs()
>> and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related
>> request would be freed.
>>
> Yes.
>
>> While since host reset failed, we can not guarantee the LLDDs has cleared all
>> references to these commands in eh_cmd_q. Is there any possibility that the
>> LLDDs reference to these commands? If this happened, then a using after free
>> issue would occur.
>>
> If host reset has failed there are _no_ assumptions we can make about commands, and not even about the PCI device itself.
> So in effect, once host_reset failed the system is hosed.
>
> We _might_ be able to resurrect the system by doing PCI EEH, but not many systems nor drivers implement that.
>
> Cheers,
>
> Hannes
>
> .
Thanks a lot for your reply. I am writing single LUN reset EH flow which discussed in previous mail
and testing it, if the test result is good I would post it.
By the way, you said you would make EH rework, are you doing it? Could you tell us your plan
if it's not secret.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-04-21 15:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-19 14:28 [Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed Wenchao Hao
2022-04-19 14:56 ` Hannes Reinecke
2022-04-21 15:24 ` Wenchao Hao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.