From: Arun Easi <aeasi@marvell.com>
To: Daniel Wagner <dwagner@suse.de>
Cc: <linux-scsi@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
"Nilesh Javali" <njavali@marvell.com>,
Martin Wilck <mwilck@suse.com>
Subject: Re: [PATCH v2 1/4] qla2xxx: Warn if done() or free() are called on an already freed srb
Date: Mon, 7 Sep 2020 23:42:32 -0700 [thread overview]
Message-ID: <alpine.LRH.2.21.9999.2009072341491.28578@irv1user01.caveonetworks.com> (raw)
In-Reply-To: <20200831161854.70879-2-dwagner@suse.de>
On Mon, 31 Aug 2020, 9:18am, Daniel Wagner wrote:
>
> Emit a warning when ->done or ->free are called on an already freed
> srb. There is a hidden use-after-free bug in the driver which corrupts
> the srb memory pool which originates from the cleanup callbacks. By
> explicitly resetting the callbacks to NULL, we workaround the memory
> corruption.
>
> An extensive search didn't bring any lights on the real problem. The
> initial idea was to set both pointers to NULL and try to catch invalid
> accesses. But instead the memory corruption was gone and the driver
> didn't crash.
>
> Signed-off-by: Daniel Wagner <dwagner@suse.de>
> ---
> drivers/scsi/qla2xxx/qla_init.c | 10 ++++++++++
> drivers/scsi/qla2xxx/qla_inline.h | 5 +++++
> 2 files changed, 15 insertions(+)
>
> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index 57a2d76aa691..9e9360a4aeb5 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c
> @@ -63,6 +63,16 @@ void qla2x00_sp_free(srb_t *sp)
> qla2x00_rel_sp(sp);
> }
>
> +void qla2xxx_rel_done_warning(srb_t *sp, int res)
> +{
> + WARN_ONCE(1, "Calling done() of an already freed srb object\n");
> +}
> +
> +void qla2xxx_rel_free_warning(srb_t *sp)
> +{
> + WARN_ONCE(1, "Calling free() of an already freed srb object\n");
> +}
Please print the address of srb too for the above two functions.
With that, looks good.
Regards,
-Arun
next prev parent reply other threads:[~2020-09-08 6:42 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-31 16:18 [PATCH v2 0/4] qla2xxx: A couple crash fixes Daniel Wagner
2020-08-31 16:18 ` [PATCH v2 1/4] qla2xxx: Warn if done() or free() are called on an already freed srb Daniel Wagner
2020-09-08 6:42 ` Arun Easi [this message]
2020-08-31 16:18 ` [PATCH v2 2/4] qla2xxx: Simplify return value logic in qla2x00_get_sp_from_handle() Daniel Wagner
2020-09-08 6:43 ` Arun Easi
2020-08-31 16:18 ` [PATCH v2 3/4] qla2xxx: Drop unused function argument from qla2x00_get_sp_from_handle() Daniel Wagner
2020-09-08 6:46 ` Arun Easi
2020-09-08 7:52 ` Daniel Wagner
2020-08-31 16:18 ` [PATCH v2 4/4] qla2xxx: Handle incorrect entry_type entries Daniel Wagner
2020-09-08 6:47 ` Arun Easi
2020-09-08 7:57 ` Daniel Wagner
2020-08-31 19:11 ` [PATCH v2 0/4] qla2xxx: A couple crash fixes Martin Wilck
2020-09-08 6:41 ` Arun Easi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LRH.2.21.9999.2009072341491.28578@irv1user01.caveonetworks.com \
--to=aeasi@marvell.com \
--cc=dwagner@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=mwilck@suse.com \
--cc=njavali@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).