From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: yuuzheng <yuuzheng@google.com>,
Jack Wang <jinpu.wang@cloud.ionos.com>,
Viswas G <Viswas.G@microchip.com>,
Ruksar Devadi <Ruksar.devadi@microchip.com>,
Radha Ramachandran <radha@google.com>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>,
linux-scsi@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 033/217] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition
Date: Tue, 22 Dec 2020 21:13:22 -0500 [thread overview]
Message-ID: <20201223021626.2790791-33-sashal@kernel.org> (raw)
In-Reply-To: <20201223021626.2790791-1-sashal@kernel.org>
From: yuuzheng <yuuzheng@google.com>
[ Upstream commit 1f889b58716a5f5e3e4fe0e6742c1a4472f29ac1 ]
A use-after-free or null-pointer error occurs when the 251-byte response
data is copied from IOMB buffer to response message buffer in function
pm8001_mpi_get_nvmd_resp().
After sending the command get_nvmd_data(), the caller begins to sleep by
calling wait_for_complete() and waits for the wake-up from calling
complete() in pm8001_mpi_get_nvmd_resp(). Due to unexpected events (e.g.,
interrupt), if response buffer gets freed before memcpy(), a use-after-free
error will occur. To fix this, the complete() should be called after
memcpy().
Link: https://lore.kernel.org/r/20201102165528.26510-5-Viswas.G@microchip.com.com
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: yuuzheng <yuuzheng@google.com>
Signed-off-by: Viswas G <Viswas.G@microchip.com>
Signed-off-by: Ruksar Devadi <Ruksar.devadi@microchip.com>
Signed-off-by: Radha Ramachandran <radha@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_hwi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index 9e9a546da9590..2054c2b03d928 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -3279,10 +3279,15 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
pm8001_ha->memoryMap.region[NVMD].virt_ptr,
fw_control_context->len);
kfree(ccb->fw_control_context);
+ /* To avoid race condition, complete should be
+ * called after the message is copied to
+ * fw_control_context->usrAddr
+ */
+ complete(pm8001_ha->nvmd_completion);
+ PM8001_MSG_DBG(pm8001_ha, pm8001_printk("Set nvm data complete!\n"));
ccb->task = NULL;
ccb->ccb_tag = 0xFFFFFFFF;
pm8001_tag_free(pm8001_ha, tag);
- complete(pm8001_ha->nvmd_completion);
}
int pm8001_mpi_local_phy_ctl(struct pm8001_hba_info *pm8001_ha, void *piomb)
--
2.27.0
next prev parent reply other threads:[~2020-12-23 3:09 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-23 2:12 [PATCH AUTOSEL 5.10 001/217] soc: aspeed-lpc-ctrl: Fail probe of lpc-ctrl if reserved memory is not aligned Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 002/217] drm/ingenic: Reset pixclock rate when parent clock rate changes Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 003/217] drm/bridge: ti-sn65dsi86: Add retries for link training Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 004/217] drm/amd/display: setup system context in dm_init Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 005/217] drm/amd/display: Fix the display corruption issue on Navi10 Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 006/217] locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 007/217] platform/x86: asus-wmi: Add support for SW_TABLET_MODE on UX360 Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 008/217] tomoyo: fix clang pointer arithmetic warning Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 009/217] HID: hid-input: occasionally report stylus battery even if not changed Sasha Levin
2020-12-23 2:12 ` [PATCH AUTOSEL 5.10 010/217] drm/amdgpu: change to save bad pages in UMC error interrupt callback Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 011/217] crypto: omap-aes - fix the reference count leak of omap device Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 012/217] drm/amd/display: Do not silently accept DCC for multiplane formats Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 013/217] ASoC: intel: sof_rt5682: Add quirk for Dooly Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 014/217] bpf: Use separate lockdep class for each hashtab Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 015/217] drm/msm: Fix race condition in msm driver with async layer updates Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 016/217] staging: wimax: depends on NET Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 017/217] RDMA/siw: Fix typo of EAGAIN not -EAGAIN in siw_cm_work_handler() Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 018/217] drm/amd/display: Fix compilation error Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 019/217] drm/amd/display: Force prefetch mode to 0 Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 020/217] drm/amd/display: Keep GSL for full updates with planes that flip VSYNC Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 021/217] drm/amd/display: stop top_mgr when type change to non-MST during s3 Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 022/217] drm/amd/display: correct eDP T9 delay Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 023/217] drm/amd/display: Update connector on DSC property change Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 024/217] drm/amd/display: fix recout calculation for left side clip Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 025/217] drm/amdgpu: disable gfxoff if VCN is busy Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 026/217] net: ethernet: ti: am65-cpsw: fix tx csum offload for multi mac mode Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 027/217] net: mscc: ocelot: don't reset the pvid to 0 when deleting it Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 028/217] drm/amdgpu: set LDS_CONFIG=0x20 on Navy Flounder to fix a GPU hang (v2) Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 029/217] scsi: target: Fix cmd_count ref leak Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 030/217] scsi: pm80xx: Make mpi_build_cmd locking consistent Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 031/217] scsi: pm80xx: Make running_req atomic Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 032/217] scsi: pm80xx: Avoid busywait in FW ready check Sasha Levin
2020-12-23 2:13 ` Sasha Levin [this message]
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 034/217] scsi: ufs: Allow an error return value from ->device_reset() Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 035/217] fcntl: Fix potential deadlock in send_sig{io, urg}() Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 036/217] drm/amdgpu: add missing clock gating info in amdgpu_pm_info Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 037/217] mac80211: don't overwrite QoS TID of injected frames Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 038/217] staging: ks7010: fix missing destroy_workqueue() on error in ks7010_sdio_probe Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 039/217] staging: rtl8192u: fix wrong judgement in rtl8192_rx_isr Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 040/217] mips: ar7: add missing iounmap() on error in ar7_gpio_init Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 041/217] mips: cm: add missing iounmap() on error in mips_cm_probe() Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 042/217] usb: typec: ucsi: Work around PPM losing change information Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 043/217] rcuscale: Prevent hangs for invalid arguments Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 044/217] refscale: " Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 045/217] locktorture: " Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 046/217] torture: Prevent jitter processes from delaying failed run Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 047/217] rcutorture: Prevent hangs for invalid arguments Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 048/217] kcsan: Fix encoding masks and regain address bit Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 049/217] ath10k: fix compilation warning Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 050/217] rsi: Fix TX EAPOL packet handling against iwlwifi AP Sasha Levin
2021-03-02 19:25 ` Marek Vasut
2021-03-04 20:47 ` Sasha Levin
2021-03-04 21:07 ` Marek Vasut
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 051/217] thermal: intel: pch: fix S0ix failure due to PCH temperature above threshold Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 052/217] drm: panel: simple: add missing platform_driver_unregister() in panel_simple_init Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 053/217] drm/bridge: lvds-codec: Use dev_err_probe for error handling Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 054/217] drm/ast: Fixed 1920x1080 sync. polarity issue Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 055/217] s390: make sure vmemmap is top region table entry aligned Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 056/217] s390/pci: remove races against pte updates Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 057/217] s390/trng: set quality to 1024 Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 058/217] Bluetooth: btqca: Add valid le states quirk Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 059/217] Bluetooth: Resume advertising after LE connection Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 060/217] Bluetooth: Move force_bredr_smp debugfs into hci_debugfs_create_bredr Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 061/217] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 062/217] binder: change error code from postive to negative in binder_transaction Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 063/217] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 064/217] drm/omap: Fix runtime PM imbalance on error Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 065/217] pinctrl: qcom: Kconfig: Rework PINCTRL_MSM to be a depenency rather then a selected config Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 066/217] ASoC: Fix vaud18 power leakage of mt6359 Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 067/217] mwifiex: pcie: skip cancel_work_sync() on reset failure path Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 068/217] drm/amd/amdgpu: Fix incorrect logic to increment VCN doorbell index Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 069/217] drm/amd/amdgpu: Add rev_id workaround logic for SRIOV setup Sasha Levin
2020-12-23 2:13 ` [PATCH AUTOSEL 5.10 070/217] ASoC: Intel: sof_sdw: add quirk for new TigerLake-SDCA device Sasha Levin
2020-12-23 2:14 ` [PATCH AUTOSEL 5.10 071/217] RDMA/core: Postpone uobject cleanup on failure till FD close Sasha Levin
2020-12-23 2:14 ` [PATCH AUTOSEL 5.10 072/217] MIPS: BMC47xx: fix kconfig dependency bug for BCM47XX_SSB Sasha Levin
2020-12-23 2:14 ` [PATCH AUTOSEL 5.10 073/217] net: ipconfig: Avoid spurious blank lines in boot log Sasha Levin
2020-12-23 2:14 ` [PATCH AUTOSEL 5.10 074/217] drm/amd/amdgpu: Update VCN initizalization behvaior Sasha Levin
2020-12-23 2:14 ` [PATCH AUTOSEL 5.10 075/217] drm/amdgpu: check hive pointer before access Sasha Levin
2020-12-23 2:14 ` [PATCH AUTOSEL 5.10 076/217] jfs: Fix memleak in dbAdjCtl Sasha Levin
2020-12-23 2:14 ` [PATCH AUTOSEL 5.10 077/217] r8169: use READ_ONCE in rtl_tx_slots_avail Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223021626.2790791-33-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=Ruksar.devadi@microchip.com \
--cc=Viswas.G@microchip.com \
--cc=jinpu.wang@cloud.ionos.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=radha@google.com \
--cc=stable@vger.kernel.org \
--cc=yuuzheng@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).