* [PATCH] scsi: mpt3sas: fix potential use-after-free in mpt3sas_base_attach
@ 2023-12-25 6:36 Dinghao Liu
0 siblings, 0 replies; only message in thread
From: Dinghao Liu @ 2023-12-25 6:36 UTC (permalink / raw)
To: dinghao.liu
Cc: Sathya Prakash, Sreekanth Reddy, Suganath Prabu Subramani,
James E.J. Bottomley, Martin K. Petersen, MPT-FusionLinux.pdl,
linux-scsi, linux-kernel
_base_allocate_memory_pools() calls _base_release_memory_pools()
to clean up memory in several error paths. However,
mpt3sas_base_attach() calls _base_release_memory_pools() again
on failure of _base_allocate_memory_pools(), which may lead to
use-after-free.
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
---
drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index a75f670bf551..9be7e493e56c 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -5844,6 +5844,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
}
dma_pool_destroy(ioc->reply_post_free_array_dma_pool);
kfree(ioc->reply_post);
+ ioc->reply_post = NULL;
}
if (ioc->pcie_sgl_dma_pool) {
@@ -5854,6 +5855,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
ioc->pcie_sg_lookup[i].pcie_sgl = NULL;
}
dma_pool_destroy(ioc->pcie_sgl_dma_pool);
+ ioc->pcie_sgl_dma_pool = NULL;
}
kfree(ioc->pcie_sg_lookup);
ioc->pcie_sg_lookup = NULL;
@@ -5864,6 +5866,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
ioc->config_page));
dma_free_coherent(&ioc->pdev->dev, ioc->config_page_sz,
ioc->config_page, ioc->config_page_dma);
+ ioc->config_page = NULL;
}
kfree(ioc->hpr_lookup);
--
2.17.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2023-12-25 6:37 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-12-25 6:36 [PATCH] scsi: mpt3sas: fix potential use-after-free in mpt3sas_base_attach Dinghao Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).