iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8fe4ce5836
linux/drivers/scsi
History
Bart Van Assche 8fe4ce5836 scsi: core: Fix a use-after-free 
There are two .exit_cmd_priv implementations. Both implementations use
resources associated with the SCSI host. Make sure that these resources are
still available when .exit_cmd_priv is called by waiting inside
scsi_remove_host() until the tag set has been freed.

This commit fixes the following use-after-free:

==================================================================
BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
Read of size 8 at addr ffff888100337000 by task multipathd/16727
Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x44
 print_report.cold+0x5e/0x5db
 kasan_report+0xab/0x120
 srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
 scsi_mq_exit_request+0x4d/0x70
 blk_mq_free_rqs+0x143/0x410
 __blk_mq_free_map_and_rqs+0x6e/0x100
 blk_mq_free_tag_set+0x2b/0x160
 scsi_host_dev_release+0xf3/0x1a0
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 scsi_device_dev_release_usercontext+0x4c1/0x4e0
 execute_in_process_context+0x23/0x90
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 scsi_disk_release+0x3f/0x50
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 disk_release+0x17f/0x1b0
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 dm_put_table_device+0xa3/0x160 [dm_mod]
 dm_put_device+0xd0/0x140 [dm_mod]
 free_priority_group+0xd8/0x110 [dm_multipath]
 free_multipath+0x94/0xe0 [dm_multipath]
 dm_table_destroy+0xa2/0x1e0 [dm_mod]
 __dm_destroy+0x196/0x350 [dm_mod]
 dev_remove+0x10c/0x160 [dm_mod]
 ctl_ioctl+0x2c2/0x590 [dm_mod]
 dm_ctl_ioctl+0x5/0x10 [dm_mod]
 __x64_sys_ioctl+0xb4/0xf0
 dm_ctl_ioctl+0x5/0x10 [dm_mod]
 __x64_sys_ioctl+0xb4/0xf0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Link: https://lore.kernel.org/r/20220826002635.919423-1-bvanassche@acm.org
Fixes: 65ca846a53 ("scsi: core: Introduce {init,exit}_cmd_priv()")
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Mike Christie <michael.christie@oracle.com>
Cc: Hannes Reinecke <hare@suse.de>
Cc: John Garry <john.garry@huawei.com>
Cc: Li Zhijian <lizhijian@fujitsu.com>
Reported-by: Li Zhijian <lizhijian@fujitsu.com>
Tested-by: Li Zhijian <lizhijian@fujitsu.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-01 01:02:10 -04:00
..
aacraid SCSI misc on 20220804 2022-08-04 19:47:37 -07:00
aic7xxx scsi: aic7xxx: Use standard PCI subsystem, subdevice defines 2022-03-30 00:00:59 -04:00
aic94xx scsi: libsas: Introduce struct smp_rps_resp 2022-06-10 13:08:06 -04:00
arcmsr scsi: arcmsr: Switch to attribute groups 2021-10-16 21:45:54 -04:00
arm scsi: arm: Move the SCSI pointer to private command data 2022-02-22 21:11:03 -05:00
be2iscsi scsi: iscsi: Remove iscsi_get_task back_lock requirement 2022-06-21 21:19:23 -04:00
bfa scsi: bfa: Remove unneeded flush_workqueue() 2022-04-25 23:38:38 -04:00
bnx2fc scsi: bnx2fc: Avoid using get_cpu() in bnx2fc_cmd_alloc() 2022-05-16 21:26:50 -04:00
bnx2i scsi: iscsi: Fix session removal on shutdown 2022-06-21 21:14:54 -04:00
csiostor scsi: csio: Stop using the SCSI pointer 2022-02-22 21:11:04 -05:00
cxgbi scsi: iscsi: Rename iscsi_conn_queue_work() 2022-06-21 21:19:22 -04:00
cxlflash scsi: cxlflash: Include missing linux/irqdomain.h 2022-07-28 16:22:12 +10:00
device_handler scsi/device_handlers: Use the new blk_opf_t type 2022-07-14 12:14:32 -06:00
elx scsi: elx: efct: Remove NULL check after calling container_of() 2022-05-19 20:16:27 -04:00
esas2r scsi: esas2r: Fix typo in comment 2022-05-23 23:24:09 -04:00
fcoe scsi: fcoe: Remove redundant assignment to variable 'wlen' 2022-06-27 22:45:25 -04:00
fnic SCSI misc on 20220804 2022-08-04 19:47:37 -07:00
hisi_sas scsi: hisi_sas: Modify v3 HW SATA completion error processing 2022-07-18 23:04:12 -04:00
ibmvscsi scsi: ibmvfc: Store vhost pointer during subcrq allocation 2022-06-16 21:42:04 -04:00
ibmvscsi_tgt scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 2022-03-29 23:39:24 -04:00
isci scsi: isci: Fix typo in comment 2022-05-23 23:24:10 -04:00
libfc scsi: libfc: Remove get_cpu() semantics in fc_exch_em_alloc() 2022-05-16 21:26:50 -04:00
libsas scsi: libsas: Resume SAS host for phy reset or enable via sysfs 2022-07-18 23:04:12 -04:00
lpfc scsi: lpfc: Add missing destroy_workqueue() in error path 2022-09-01 01:02:10 -04:00
megaraid Merge branch '5.20/scsi-queue' into 6.0/scsi-fixes 2022-08-19 17:28:54 -04:00
mpi3mr SCSI misc on 20220804 2022-08-04 19:47:37 -07:00
mpt3sas SCSI misc on 20220804 2022-08-04 19:47:37 -07:00
mvsas scsi: mvsas: Add PCI ID of RocketRaid 2640 2022-04-06 22:27:08 -04:00
pcmcia scsi: sym53c500_cs: Stop using struct scsi_pointer 2022-04-06 22:11:52 -04:00
pm8001 SCSI misc on 20220813 2022-08-13 13:41:48 -07:00
qedf scsi: qedf: Fix typo in comment 2022-05-23 23:24:10 -04:00
qedi scsi: iscsi: Fix session removal on shutdown 2022-06-21 21:14:54 -04:00
qla2xxx scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX 2022-08-11 21:57:15 -04:00
qla4xxx scsi: qla4xxx: Drop redundant memset() 2022-04-25 23:33:36 -04:00
smartpqi scsi: smartpqi: Update version to 2.1.18-045 2022-07-13 23:42:05 -04:00
snic SCSI misc on 20220804 2022-08-04 19:47:37 -07:00
sym53c8xx_2 scsi: sym53c8xx_2: Remove redundant "with" 2022-06-21 21:41:19 -04:00
.gitignore
3w-9xxx.c scsi: 3w-9xxx: Switch to attribute groups 2021-10-16 21:45:53 -04:00
3w-9xxx.h
3w-sas.c scsi: 3w-sas: Remove useless DMA-32 fallback configuration 2022-01-24 23:30:28 -05:00
3w-sas.h
3w-xxxx.c scsi: 3w-xxx: Remove redundant initialization of variable retval 2021-10-18 22:38:34 -04:00
3w-xxxx.h
53c700_d.h_shipped
53c700.c scsi: 53c700: Stop clearing SCSI pointer fields 2022-02-22 21:11:03 -05:00
53c700.h
53c700.scr
a100u2w.c scsi: a100u2w: Fix a kernel-doc warning 2021-11-29 23:02:13 -05:00
a100u2w.h
a2091.c scsi: a2091: Convert m68k WD33C93 drivers to DMA API 2022-07-07 17:01:22 -04:00
a2091.h
a3000.c scsi: a3000: Convert m68k WD33C93 drivers to DMA API 2022-07-07 17:01:22 -04:00
a3000.h
a4000t.c
advansys.c scsi: advansys: Move the SCSI pointer to private command data 2022-02-22 21:11:03 -05:00
aha152x.c scsi: aha152x: Stop using struct scsi_pointer 2022-03-29 23:42:18 -04:00
aha152x.h
aha1542.c scsi: aha1542: Remove unneeded semicolon 2022-04-25 23:25:11 -04:00
aha1542.h
aha1740.c scsi: Remove drivers/scsi/scsi.h 2022-02-22 21:11:02 -05:00
aha1740.h
am53c974.c
atari_scsi.c scsi: NCR5380: Add SCp members to struct NCR5380_cmd 2022-02-22 21:11:03 -05:00
atp870u.c scsi: atp870u: Fix a kernel-doc warning 2021-11-29 23:02:13 -05:00
atp870u.h
BusLogic.c scsi: BusLogic: Remove bus_to_virt() 2022-06-27 22:52:05 -04:00
BusLogic.h
bvme6000_scsi.c
ch.c scsi: ch: Do not initialise statics to 0 2022-07-26 22:13:29 -04:00
constants.c
dc395x.c scsi: dc395x: Fix a missing check on list iterator 2022-04-26 08:51:56 -04:00
dc395x.h
dmx3191d.c scsi: NCR5380: Remove the NCR5380_CMD_SIZE macro 2022-02-22 21:11:03 -05:00
esp_scsi.c scsi: esp_scsi: Stop using the SCSI pointer 2022-02-22 21:11:04 -05:00
esp_scsi.h scsi: esp_scsi: Stop using the SCSI pointer 2022-02-22 21:11:04 -05:00
fdomain_isa.c
fdomain_pci.c
fdomain.c scsi: fdomain: Move the SCSI pointer to private command data 2022-02-22 21:11:04 -05:00
fdomain.h
FlashPoint.c scsi: FlashPoint: Remove redundant variable bm_int_st 2022-08-01 19:52:03 -04:00
g_NCR5380.c scsi: NCR5380: Add SCp members to struct NCR5380_cmd 2022-02-22 21:11:03 -05:00
gvp11.c scsi: gvp11.c: Fix DMA mask calculation error 2022-07-13 23:18:26 -04:00
gvp11.h
hosts.c scsi: core: Fix a use-after-free 2022-09-01 01:02:10 -04:00
hpsa_cmd.h
hpsa.c scsi: hpsa: Remove an unused variable in hpsa_update_scsi_devices() 2021-12-13 23:34:01 -05:00
hpsa.h
hptiop.c scsi: hptiop: Stop using the SCSI pointer 2022-02-22 21:11:04 -05:00
hptiop.h scsi: hptiop: Stop using the SCSI pointer 2022-02-22 21:11:04 -05:00
imm.c scsi: imm: Move the SCSI pointer to private command data 2022-02-22 21:11:04 -05:00
imm.h scsi: imm: Move the SCSI pointer to private command data 2022-02-22 21:11:04 -05:00
initio.c scsi: initio: Stop using the SCSI pointer 2022-02-22 21:11:05 -05:00
initio.h scsi: initio: Stop using the SCSI pointer 2022-02-22 21:11:05 -05:00
ipr.c scsi: ipr: Fix missing/incorrect resource cleanup in error case 2022-06-07 22:05:14 -04:00
ipr.h
ips.c scsi: Remove drivers/scsi/scsi.h 2022-02-22 21:11:02 -05:00
ips.h
iscsi_boot_sysfs.c
iscsi_tcp.c scsi: iscsi_tcp: Drop target_alloc use 2022-06-21 21:19:23 -04:00
iscsi_tcp.h scsi: iscsi: Run recv path from workqueue 2022-06-21 21:19:22 -04:00
jazz_esp.c
Kconfig scsi: dpt_i2o: Remove obsolete driver 2022-06-27 22:56:21 -04:00
lasi700.c parisc: Make struct parisc_driver::remove() return void 2021-08-30 10:18:25 +02:00
libiscsi_tcp.c scsi: iscsi: Remove iscsi_get_task back_lock requirement 2022-06-21 21:19:23 -04:00
libiscsi.c scsi: libiscsi: Improve conn_send_pdu API 2022-06-21 21:19:23 -04:00
mac53c94.c scsi: mac53c94: Fix warning comparing pointer to 0 2022-04-25 23:23:05 -04:00
mac53c94.h scsi: mac53c94: Stop using struct scsi_pointer 2022-02-27 21:35:30 -05:00
mac_esp.c
mac_scsi.c scsi: NCR5380: Add SCp members to struct NCR5380_cmd 2022-02-22 21:11:03 -05:00
Makefile scsi: dpt_i2o: Remove obsolete driver 2022-06-27 22:56:21 -04:00
megaraid.c scsi: megaraid: Fix error check return value of register_chrdev() 2022-04-26 09:02:44 -04:00
megaraid.h scsi: megaraid: Stop using the SCSI pointer 2022-02-22 21:11:05 -05:00
mesh.c powerpc/powermac: Remove empty function note_scsi_host() 2022-06-26 10:29:44 +10:00
mesh.h scsi: mesh: Stop using struct scsi_pointer 2022-02-27 21:34:02 -05:00
mvme16x_scsi.c
mvme147.c scsi: wd33c93: Move the SCSI pointer to private command data 2022-02-22 21:11:07 -05:00
mvme147.h
mvumi.c scsi: mvumi: Stop using the SCSI pointer 2022-02-22 21:11:06 -05:00
mvumi.h scsi: mvumi: Stop using the SCSI pointer 2022-02-22 21:11:06 -05:00
myrb.c scsi: myrb: Fix up null pointer access on myrb_cleanup() 2022-05-23 23:24:10 -04:00
myrb.h
myrs.c scsi: myrs: Fix crash in error case 2022-01-25 00:09:41 -05:00
myrs.h
ncr53c8xx.c scsi: zalon: Stop using the SCSI pointer 2022-02-22 21:11:07 -05:00
ncr53c8xx.h scsi: zalon: Stop using the SCSI pointer 2022-02-22 21:11:07 -05:00
NCR5380.c scsi: NCR5380: Add SCp members to struct NCR5380_cmd 2022-02-22 21:11:03 -05:00
NCR5380.h scsi: NCR5380: Add SCp members to struct NCR5380_cmd 2022-02-22 21:11:03 -05:00
nsp32_debug.c
nsp32_io.h
nsp32.c scsi: nsp32: Stop using the SCSI pointer 2022-02-22 21:11:06 -05:00
nsp32.h scsi: nsp32: Stop using the SCSI pointer 2022-02-22 21:11:06 -05:00
pmcraid.c scsi: pmcraid: Fix missing resource cleanup in error case 2022-06-07 22:05:14 -04:00
pmcraid.h scsi: pmcraid: Remove the PMCRAID_PASSTHROUGH_IOCTL ioctl implementation 2022-03-29 23:32:26 -04:00
ppa.c scsi: ppa: Move the SCSI pointer to private command data 2022-02-22 21:11:06 -05:00
ppa.h
ps3rom.c scsi: core: Remove the 'done' argument from SCSI queuecommand_lck functions 2021-10-16 21:32:16 -04:00
qla1280.c scsi: qla1280: Remove redundant variable 2022-05-19 20:26:21 -04:00
qla1280.h scsi: qla1280: Move the SCSI pointer to private command data 2022-02-22 21:11:06 -05:00
qlogicfas408.c scsi: Remove drivers/scsi/scsi.h 2022-02-22 21:11:02 -05:00
qlogicfas408.h
qlogicfas.c scsi: Remove drivers/scsi/scsi.h 2022-02-22 21:11:02 -05:00
qlogicpti.c scsi: core: Remove the 'done' argument from SCSI queuecommand_lck functions 2021-10-16 21:32:16 -04:00
qlogicpti.h
raid_class.c
script_asm.pl
scsi_bsg.c scsi: bsg: Drop needless assignment in scsi_bsg_sg_io_fn() 2022-03-15 14:05:02 -04:00
scsi_common.c
scsi_debug.c scsi: scsi_debug: Fix zone transition to full condition 2022-06-10 12:50:05 -04:00
scsi_debugfs.c scsi: core: Remove struct scsi_request 2022-03-01 22:21:50 -05:00
scsi_debugfs.h
scsi_devinfo.c
scsi_dh.c
scsi_error.c SCSI misc on 20220804 2022-08-04 19:47:37 -07:00
scsi_ioctl.c scsi: core: Fix warning in scsi_alloc_sgtables() 2022-07-26 21:54:30 -04:00
scsi_lib_dma.c
scsi_lib.c scsi: core: Fix a use-after-free 2022-09-01 01:02:10 -04:00
scsi_logging.c scsi: core: scsi_logging: Fix a BUG 2022-03-29 23:29:19 -04:00
scsi_logging.h
scsi_netlink.c
scsi_pm.c scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() 2021-12-22 23:38:29 -05:00
scsi_priv.h scsi: core: Fix a use-after-free 2022-09-01 01:02:10 -04:00
scsi_proc.c proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
scsi_sas_internal.h
scsi_scan.c scsi: core: Fix a use-after-free 2022-09-01 01:02:10 -04:00
scsi_sysctl.c
scsi_sysfs.c scsi: core: Fix a use-after-free 2022-09-01 01:02:10 -04:00
scsi_trace.c
scsi_transport_api.h
scsi_transport_fc.c scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters 2022-03-01 23:56:27 -05:00
scsi_transport_iscsi.c Merge branch '5.19/scsi-fixes' into 5.20/scsi-staging 2022-07-07 17:20:43 -04:00
scsi_transport_sas.c scsi: scsi_transport_sas: cap shost opt_sectors according to DMA optimal limit 2022-07-19 11:11:49 +02:00
scsi_transport_spi.c
scsi_transport_srp.c
scsi.c scsi: core: Revert "Simplify LLD module reference counting" 2022-09-01 01:02:10 -04:00
scsicam.c scsicam: Fix use of page cache 2022-05-08 14:28:18 -04:00
sd_dif.c scsi: sd: Reorganize DIF/DIX code to avoid calling revalidate twice 2022-05-02 16:59:11 -04:00
sd_zbc.c treewide: Rename enum req_opf into enum req_op 2022-07-14 12:14:30 -06:00
sd.c scsi: sd: Revert "Rework asynchronous resume support" 2022-08-22 22:45:25 -04:00
sd.h scsi: sd: Revert "Rework asynchronous resume support" 2022-08-22 22:45:25 -04:00
sense_codes.h
ses.c scsi: ses: Fix unsigned comparison with less than zero 2021-09-28 22:42:06 -04:00
sg.c scsi: sg: Allow waiting for commands to complete on removed device 2022-07-18 22:33:04 -04:00
sgiwd93.c scsi: wd33c93: Move the SCSI pointer to private command data 2022-02-22 21:11:07 -05:00
sim710.c
sni_53c710.c
sr_ioctl.c scsi: sr: Do not leak information in ioctl 2022-04-18 22:48:31 -04:00
sr_vendor.c scsi: sr: Don't use GFP_DMA 2021-12-22 23:41:13 -05:00
sr.c block: simplify disk shutdown 2022-06-28 06:30:26 -06:00
sr.h sr: implement ->free_disk to simplify refcounting 2022-03-08 19:40:01 -07:00
st_options.h
st.c blk-mq: remove the done argument to blk_execute_rq_nowait 2022-05-28 06:15:27 -06:00
st.h scsi: don't use disk->private_data to find the scsi_driver 2022-03-08 19:40:00 -07:00
stex.c scsi: core: Remove the 'done' argument from SCSI queuecommand_lck functions 2021-10-16 21:32:16 -04:00
storvsc_drv.c scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq 2022-08-11 22:25:23 -04:00
sun3_scsi_vme.c
sun3_scsi.c scsi: NCR5380: Add SCp members to struct NCR5380_cmd 2022-02-22 21:11:03 -05:00
sun3x_esp.c
sun_esp.c
virtio_scsi.c scsi: virtio-scsi: Eliminate anonymous module_init & module_exit 2022-03-29 23:49:56 -04:00
vmw_pvscsi.c scsi: vmw_pvscsi: No need to clear memory after a dma_alloc_coherent() call 2022-04-06 23:01:54 -04:00
vmw_pvscsi.h scsi: vmw_pvscsi: Expand vcpuHint to 16 bits 2022-06-07 21:30:56 -04:00
wd33c93.c scsi: wd33c93: Move the SCSI pointer to private command data 2022-02-22 21:11:07 -05:00
wd33c93.h scsi: wd33c93: Move the SCSI pointer to private command data 2022-02-22 21:11:07 -05:00
wd719x.c scsi: wd719x: Return proper error code when dma_set_mask() fails 2022-03-01 23:56:28 -05:00
wd719x.h scsi: wd719x: Stop using the SCSI pointer 2022-02-22 21:11:07 -05:00
xen-scsifront.c xen/scsifront: use xenbus_setup_ring() and xenbus_teardown_ring() 2022-05-19 14:22:03 +02:00
zalon.c scsi: zalon: Stop using the SCSI pointer 2022-02-22 21:11:07 -05:00
zorro7xx.c scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() 2022-03-30 00:05:42 -04:00
zorro_esp.c