* [PATCH] scsi: qla2xxx: avoid crash in qlt_handle_abts_completion() if mcmd == NULL
@ 2019-11-04 18:18 Thomas Abraham
2019-11-11 17:32 ` Roman Bolshakov
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Thomas Abraham @ 2019-11-04 18:18 UTC (permalink / raw)
To: hmadhani
Cc: jejb, martin.petersen, linux-scsi, linux-kernel, hare, Thomas Abraham
qlt_ctio_to_cmd() will return a NULL mcmd if h == QLA_TGT_SKIP_HANDLE. If
the error subcodes don't match the exact codes checked a crash will occur
when calling free_mcmd on the null mcmd
Signed-off-by: Thomas Abraham <tabraham@suse.com>
---
drivers/scsi/qla2xxx/qla_target.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index a06e56224a55..611ab224662f 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -5732,7 +5732,8 @@ static void qlt_handle_abts_completion(struct scsi_qla_host *vha,
vha->vp_idx, entry->compl_status,
entry->error_subcode1,
entry->error_subcode2);
- ha->tgt.tgt_ops->free_mcmd(mcmd);
+ if (mcmd)
+ ha->tgt.tgt_ops->free_mcmd(mcmd);
}
} else if (mcmd) {
ha->tgt.tgt_ops->free_mcmd(mcmd);
--
2.16.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: qla2xxx: avoid crash in qlt_handle_abts_completion() if mcmd == NULL
2019-11-04 18:18 [PATCH] scsi: qla2xxx: avoid crash in qlt_handle_abts_completion() if mcmd == NULL Thomas Abraham
@ 2019-11-11 17:32 ` Roman Bolshakov
2019-11-13 1:41 ` Martin K. Petersen
2019-11-20 17:08 ` Lee Duncan
2 siblings, 0 replies; 4+ messages in thread
From: Roman Bolshakov @ 2019-11-11 17:32 UTC (permalink / raw)
To: Thomas Abraham
Cc: hmadhani, jejb, martin.petersen, linux-scsi, linux-kernel, hare
Hi Thomas,
The fix for the issue was sent earlier:
https://patchwork.kernel.org/patch/11141981/
It's not important to me what fixes goes into tree but I'd like to keep
the commit message because it covers how the situation arises. Also, the
cover letter of the patch series points out another issue not covered in
either of the fixes (lack of explicit LOGO instead of BA_RJT).
Thank you,
Roman
On Mon, Nov 04, 2019 at 01:18:03PM -0500, Thomas Abraham wrote:
> qlt_ctio_to_cmd() will return a NULL mcmd if h == QLA_TGT_SKIP_HANDLE. If
> the error subcodes don't match the exact codes checked a crash will occur
> when calling free_mcmd on the null mcmd
>
> Signed-off-by: Thomas Abraham <tabraham@suse.com>
> ---
> drivers/scsi/qla2xxx/qla_target.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
> index a06e56224a55..611ab224662f 100644
> --- a/drivers/scsi/qla2xxx/qla_target.c
> +++ b/drivers/scsi/qla2xxx/qla_target.c
> @@ -5732,7 +5732,8 @@ static void qlt_handle_abts_completion(struct scsi_qla_host *vha,
> vha->vp_idx, entry->compl_status,
> entry->error_subcode1,
> entry->error_subcode2);
> - ha->tgt.tgt_ops->free_mcmd(mcmd);
> + if (mcmd)
> + ha->tgt.tgt_ops->free_mcmd(mcmd);
> }
> } else if (mcmd) {
> ha->tgt.tgt_ops->free_mcmd(mcmd);
> --
> 2.16.4
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: qla2xxx: avoid crash in qlt_handle_abts_completion() if mcmd == NULL
2019-11-04 18:18 [PATCH] scsi: qla2xxx: avoid crash in qlt_handle_abts_completion() if mcmd == NULL Thomas Abraham
2019-11-11 17:32 ` Roman Bolshakov
@ 2019-11-13 1:41 ` Martin K. Petersen
2019-11-20 17:08 ` Lee Duncan
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2019-11-13 1:41 UTC (permalink / raw)
To: hmadhani
Cc: Thomas Abraham, jejb, martin.petersen, linux-scsi, linux-kernel, hare
Himanshu: Ping.
Also see: https://patchwork.kernel.org/patch/11141981/
> qlt_ctio_to_cmd() will return a NULL mcmd if h == QLA_TGT_SKIP_HANDLE. If
> the error subcodes don't match the exact codes checked a crash will occur
> when calling free_mcmd on the null mcmd
>
> Signed-off-by: Thomas Abraham <tabraham@suse.com>
> ---
> drivers/scsi/qla2xxx/qla_target.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
> index a06e56224a55..611ab224662f 100644
> --- a/drivers/scsi/qla2xxx/qla_target.c
> +++ b/drivers/scsi/qla2xxx/qla_target.c
> @@ -5732,7 +5732,8 @@ static void qlt_handle_abts_completion(struct scsi_qla_host *vha,
> vha->vp_idx, entry->compl_status,
> entry->error_subcode1,
> entry->error_subcode2);
> - ha->tgt.tgt_ops->free_mcmd(mcmd);
> + if (mcmd)
> + ha->tgt.tgt_ops->free_mcmd(mcmd);
> }
> } else if (mcmd) {
> ha->tgt.tgt_ops->free_mcmd(mcmd);
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: qla2xxx: avoid crash in qlt_handle_abts_completion() if mcmd == NULL
2019-11-04 18:18 [PATCH] scsi: qla2xxx: avoid crash in qlt_handle_abts_completion() if mcmd == NULL Thomas Abraham
2019-11-11 17:32 ` Roman Bolshakov
2019-11-13 1:41 ` Martin K. Petersen
@ 2019-11-20 17:08 ` Lee Duncan
2 siblings, 0 replies; 4+ messages in thread
From: Lee Duncan @ 2019-11-20 17:08 UTC (permalink / raw)
To: Tom Abraham, Himanshu Madhani
Cc: jejb, martin.petersen, linux-scsi, linux-kernel, Hannes Reinecke
On 11/4/19 10:18 AM, Thomas Abraham wrote:
> qlt_ctio_to_cmd() will return a NULL mcmd if h == QLA_TGT_SKIP_HANDLE. If
> the error subcodes don't match the exact codes checked a crash will occur
> when calling free_mcmd on the null mcmd
>
> Signed-off-by: Thomas Abraham <tabraham@suse.com>
> ---
> drivers/scsi/qla2xxx/qla_target.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
> index a06e56224a55..611ab224662f 100644
> --- a/drivers/scsi/qla2xxx/qla_target.c
> +++ b/drivers/scsi/qla2xxx/qla_target.c
> @@ -5732,7 +5732,8 @@ static void qlt_handle_abts_completion(struct scsi_qla_host *vha,
> vha->vp_idx, entry->compl_status,
> entry->error_subcode1,
> entry->error_subcode2);
> - ha->tgt.tgt_ops->free_mcmd(mcmd);
> + if (mcmd)
> + ha->tgt.tgt_ops->free_mcmd(mcmd);
> }
> } else if (mcmd) {
> ha->tgt.tgt_ops->free_mcmd(mcmd);
>
Reviewed-by: Lee Duncan <lduncan@suse.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-11-20 18:39 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-04 18:18 [PATCH] scsi: qla2xxx: avoid crash in qlt_handle_abts_completion() if mcmd == NULL Thomas Abraham
2019-11-11 17:32 ` Roman Bolshakov
2019-11-13 1:41 ` Martin K. Petersen
2019-11-20 17:08 ` Lee Duncan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).