From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752507AbdEPOzm (ORCPT ); Tue, 16 May 2017 10:55:42 -0400 Received: from mail-yw0-f175.google.com ([209.85.161.175]:35861 "EHLO mail-yw0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751030AbdEPOzi (ORCPT ); Tue, 16 May 2017 10:55:38 -0400 MIME-Version: 1.0 In-Reply-To: <20170516145244.19402-1-firogm@gmail.com> References: <20170516145244.19402-1-firogm@gmail.com> From: Andrey Konovalov Date: Tue, 16 May 2017 16:55:37 +0200 Message-ID: Subject: Re: [PATCH] scsi: sg: Fix mismatch in sg_get_rq_mark To: firogm@gmail.com Cc: Doug Gilbert , Dmitry Vyukov , "James E.J. Bottomley" , "Martin K. Petersen" , linux-scsi@vger.kernel.org, syzkaller , LKML Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, May 16, 2017 at 4:52 PM, wrote: > From: Firo Yang > > This bug was reported by Andrey Konovalov with syzkaller: > > Call Trace: > sg_finish_rem_req+0x2a6/0x320 drivers/scsi/sg.c:1839 > sg_new_read+0x3c/0x430 drivers/scsi/sg.c:567 > sg_read+0x866/0x1830 drivers/scsi/sg.c:455 > __vfs_read+0x5c3/0x750 fs/read_write.c:450 > vfs_read+0x11e/0x350 fs/read_write.c:473 > SYSC_read fs/read_write.c:589 > SyS_read+0xfb/0x230 fs/read_write.c:582 > entry_SYSCALL_64_fastpath+0x1f/0xbe arch/x86/entry/entry_64.S:204 > > If there is nothing matched in the loop of list_for_each_entry, > at last the iteration variable 'resp' will point to > list_entry(&sfp->rq_list, typeof(resp), entry); it's not a valid > Sg_request. Finnally, 'resp' will be wrongly returned to the caller > function. > > To fix it, add another return variable to record the correct > match and return it to the caller function. I think this was already fixed by https://lkml.org/lkml/2017/5/10/83 Thanks! > > Signed-off-by: Firo Yang > --- > drivers/scsi/sg.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c > index 0a38ba0..74a9188 100644 > --- a/drivers/scsi/sg.c > +++ b/drivers/scsi/sg.c > @@ -2065,7 +2065,7 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp) > static Sg_request * > sg_get_rq_mark(Sg_fd * sfp, int pack_id) > { > - Sg_request *resp; > + Sg_request *resp, *ret_resp = NULL; > unsigned long iflags; > > write_lock_irqsave(&sfp->rq_list_lock, iflags); > @@ -2074,11 +2074,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id) > if ((1 == resp->done) && (!resp->sg_io_owned) && > ((-1 == pack_id) || (resp->header.pack_id == pack_id))) { > resp->done = 2; /* guard against other readers */ > + ret_resp = resp; > break; > } > } > write_unlock_irqrestore(&sfp->rq_list_lock, iflags); > - return resp; > + return ret_resp; > } > > /* always adds to end of list */ > -- > 2.9.4 > > -- > You received this message because you are subscribed to the Google Groups "syzkaller" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com. > For more options, visit https://groups.google.com/d/optout.