From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dmitry Fomichev <dmitry.fomichev@wdc.com>,
Mike Christie <mchristi@redhat.com>,
Damien Le Moal <damien.lemoal@wdc.com>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>,
linux-scsi@vger.kernel.org, target-devel@vger.kernel.org
Subject: [PATCH AUTOSEL 5.2 30/76] scsi: target: tcmu: avoid use-after-free after command timeout
Date: Thu, 29 Aug 2019 14:12:25 -0400 [thread overview]
Message-ID: <20190829181311.7562-30-sashal@kernel.org> (raw)
In-Reply-To: <20190829181311.7562-1-sashal@kernel.org>
From: Dmitry Fomichev <dmitry.fomichev@wdc.com>
[ Upstream commit a86a75865ff4d8c05f355d1750a5250aec89ab15 ]
In tcmu_handle_completion() function, the variable called read_len is
always initialized with a value taken from se_cmd structure. If this
function is called to complete an expired (timed out) out command, the
session command pointed by se_cmd is likely to be already deallocated by
the target core at that moment. As the result, this access triggers a
use-after-free warning from KASAN.
This patch fixes the code not to touch se_cmd when completing timed out
TCMU commands. It also resets the pointer to se_cmd at the time when the
TCMU_CMD_BIT_EXPIRED flag is set because it is going to become invalid
after calling target_complete_cmd() later in the same function,
tcmu_check_expired_cmd().
Signed-off-by: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Acked-by: Mike Christie <mchristi@redhat.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_user.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index b43d6385a1a09..95b2371fb67b6 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1132,14 +1132,16 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
struct se_cmd *se_cmd = cmd->se_cmd;
struct tcmu_dev *udev = cmd->tcmu_dev;
bool read_len_valid = false;
- uint32_t read_len = se_cmd->data_length;
+ uint32_t read_len;
/*
* cmd has been completed already from timeout, just reclaim
* data area space and free cmd
*/
- if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
+ if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
+ WARN_ON_ONCE(se_cmd);
goto out;
+ }
list_del_init(&cmd->queue_entry);
@@ -1152,6 +1154,7 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
goto done;
}
+ read_len = se_cmd->data_length;
if (se_cmd->data_direction == DMA_FROM_DEVICE &&
(entry->hdr.uflags & TCMU_UFLAG_READ_LEN) && entry->rsp.read_len) {
read_len_valid = true;
@@ -1307,6 +1310,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
*/
scsi_status = SAM_STAT_CHECK_CONDITION;
list_del_init(&cmd->queue_entry);
+ cmd->se_cmd = NULL;
} else {
list_del_init(&cmd->queue_entry);
idr_remove(&udev->commands, id);
@@ -2024,6 +2028,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
idr_remove(&udev->commands, i);
if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
+ WARN_ON(!cmd->se_cmd);
list_del_init(&cmd->queue_entry);
if (err_level == 1) {
/*
--
2.20.1
next prev parent reply other threads:[~2019-08-29 18:32 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-29 18:11 [PATCH AUTOSEL 5.2 01/76] batman-adv: Fix netlink dumping of all mcast_flags buckets Sasha Levin
2019-08-29 18:11 ` [PATCH AUTOSEL 5.2 02/76] libbpf: fix erroneous multi-closing of BTF FD Sasha Levin
2019-08-29 18:11 ` [PATCH AUTOSEL 5.2 03/76] libbpf: set BTF FD for prog only when there is supported .BTF.ext data Sasha Levin
2019-08-29 18:11 ` [PATCH AUTOSEL 5.2 04/76] netfilter: nf_flow_table: fix offload for flows that are subject to xfrm Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 05/76] net/mlx5e: Fix error flow of CQE recovery on tx reporter Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 06/76] clk: samsung: Change signature of exynos5_subcmus_init() function Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 07/76] clk: samsung: exynos5800: Move MAU subsystem clocks to MAU sub-CMU Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 08/76] clk: samsung: exynos542x: Move MSCL subsystem clocks to its sub-CMU Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 09/76] net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 10/76] netfilter: nf_tables: use-after-free in failing rule with bound set Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 11/76] netfilter: nf_flow_table: conntrack picks up expired flows Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 12/76] netfilter: nf_flow_table: teardown flow timeout race Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 13/76] rxrpc: Fix local endpoint refcounting Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 14/76] tools: bpftool: fix error message (prog -> object) Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 15/76] ixgbe: fix possible deadlock in ixgbe_service_task() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 16/76] hv_netvsc: Fix a warning of suspicious RCU usage Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 17/76] net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 18/76] Bluetooth: btqca: Add a short delay before downloading the NVM Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 19/76] Bluetooth: hci_qca: Send VS pre shutdown command Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 20/76] Bluetooth: hidp: Let hidp_send_message return number of queued bytes Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 21/76] s390/qeth: serialize cmd reply with concurrent timeout Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 22/76] ibmveth: Convert multicast list size for little-endian system Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 23/76] gpio: Fix build error of function redefinition Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 24/76] netfilter: nft_flow_offload: skip tcp rst and fin packets Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 25/76] rxrpc: Fix local endpoint replacement Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 26/76] rxrpc: Fix read-after-free in rxrpc_queue_local() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 27/76] drm/mediatek: use correct device to import PRIME buffers Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 28/76] drm/mediatek: set DMA max segment size Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 29/76] scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure Sasha Levin
2019-08-29 18:12 ` Sasha Levin [this message]
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 31/76] cxgb4: fix a memory leak bug Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 32/76] selftests: kvm: do not try running the VM in vmx_set_nested_state_test Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 33/76] selftests: kvm: provide common function to enable eVMCS Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 34/76] selftests: kvm: fix vmx_set_nested_state_test Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 35/76] liquidio: add cleanup in octeon_setup_iq() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 36/76] net: myri10ge: fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 37/76] clk: Fix falling back to legacy parent string matching Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 38/76] clk: Fix potential NULL dereference in clk_fetch_parent_index() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 39/76] lan78xx: Fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 40/76] vfs: fix page locking deadlocks when deduping files Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 41/76] cx82310_eth: fix a memory leak bug Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 42/76] net: kalmia: fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 43/76] ibmvnic: Unmap DMA address of TX descriptor buffers after use Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 44/76] net: cavium: fix driver name Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 45/76] wimax/i2400m: fix a memory leak bug Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 46/76] ravb: Fix use-after-free ravb_tstamp_skb Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 47/76] sched/core: Schedule new worker even if PI-blocked Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 48/76] kprobes: Fix potential deadlock in kprobe_optimizer() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 49/76] HID: intel-ish-hid: ipc: add EHL device id Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 50/76] HID: cp2112: prevent sleeping function called from invalid context Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 51/76] x86/boot/compressed/64: Fix boot on machines with broken E820 table Sasha Levin
2019-08-29 22:17 ` Kirill A. Shutemov
2019-08-30 12:06 ` Sasha Levin
2019-08-30 13:25 ` Kirill A. Shutemov
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 52/76] scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 53/76] Input: hyperv-keyboard: Use in-place iterator API in the channel callback Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 54/76] Tools: hv: kvp: eliminate 'may be used uninitialized' warning Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 55/76] io_uring: fix potential hang with polled IO Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 56/76] nvme-multipath: fix possible I/O hang when paths are updated Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 57/76] nvme: Fix cntlid validation when not using NVMEoF Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 58/76] io_uring: don't enter poll loop if we have CQEs pending Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 59/76] RDMA/cma: fix null-ptr-deref Read in cma_cleanup Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 60/76] IB/mlx4: Fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 61/76] infiniband: hfi1: fix a memory leak bug Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 62/76] infiniband: hfi1: fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 63/76] selftests: kvm: fix state save/load on processors without XSAVE Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 64/76] selftests/kvm: make platform_info_test pass on AMD Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 65/76] drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 66/76] ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() Sasha Levin
2019-08-29 20:51 ` Ilya Dryomov
2019-08-29 21:16 ` Sasha Levin
2019-08-30 8:31 ` Ilya Dryomov
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 67/76] ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob() Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 68/76] ceph: fix buffer free while holding i_ceph_lock in fill_inode() Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 69/76] KVM: arm/arm64: Only skip MMIO insn once Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 70/76] afs: Fix leak in afs_lookup_cell_rcu() Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 71/76] afs: Fix possible oops in afs_lookup trace event Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 72/76] afs: use correct afs_call_type in yfs_fs_store_opaque_acl2 Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 73/76] RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 74/76] io_uring: add need_resched() check in inner poll loop Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 75/76] gpio: Fix irqchip initialization order Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 76/76] KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190829181311.7562-30-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=damien.lemoal@wdc.com \
--cc=dmitry.fomichev@wdc.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=mchristi@redhat.com \
--cc=stable@vger.kernel.org \
--cc=target-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).