iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/scsi
History
Yuan Can 71beab7119 scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() 
[ Upstream commit e208a1d795a08d1ac0398c79ad9c58106531bcc5 ]

If device_register() fails in sdebug_add_host_helper(), it will goto clean
and sdbg_host will be freed, but sdbg_host->host_list will not be removed
from sdebug_host_list, then list traversal may cause UAF. Fix it.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Link: https://lore.kernel.org/r/20221117084421.58918-1-yuancan@huawei.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-11-26 09:24:50 +01:00
..
aacraid
scsi: aacraid: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:38 -04:00
aic7xxx
SCSI misc on 20210711
2021-07-11 10:59:53 -07:00
aic94xx
SCSI misc on 20210711
2021-07-11 10:59:53 -07:00
arcmsr
scsi: arcmsr: Avoid over-read of sense buffer
2021-06-18 23:26:33 -04:00
arm
scsi: acornscsi: Remove scsi_cmd_to_tag() reference
2021-10-04 21:54:18 -04:00
be2iscsi
scsi: iscsi: Fix session removal on shutdown
2022-08-17 14:23:45 +02:00
bfa
scsi: bfa: Replace snprintf() with sysfs_emit()
2022-04-13 20:59:02 +02:00
bnx2fc
scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
2022-02-08 18:34:11 +01:00
bnx2i
scsi: iscsi: Fix session removal on shutdown
2022-08-17 14:23:45 +02:00
csiostor
scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
2021-11-18 19:16:52 +01:00
cxgbi
scsi: iscsi: Rename iscsi_conn_queue_work()
2022-10-26 12:35:15 +02:00
cxlflash
pci-v5.15-changes
2021-09-07 19:13:42 -07:00
device_handler
scsi: scsi_dh_alua: Properly handle the ALUA transitioning state
2022-05-25 09:57:34 +02:00
dpt
scsi: docs: convert dpti.txt to ReST
2020-03-11 23:07:59 -04:00
elx
scsi: elx: efct: Don't use GFP_KERNEL under spin lock
2022-02-01 17:27:07 +01:00
esas2r
Merge branch '5.14/scsi-result' into 5.14/scsi-staging
2021-06-02 01:37:04 -04:00
fcoe
scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
2022-06-09 10:23:07 +02:00
fnic
scsi: fnic: Fix a tracing statement
2022-04-08 14:23:33 +02:00
hisi_sas
scsi: hisi_sas: Use managed PCI functions
2022-08-17 14:23:06 +02:00
ibmvscsi
scsi: ibmvfc: Allocate/free queue resource only during probe/remove
2022-06-29 09:03:19 +02:00
ibmvscsi_tgt
scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
2022-04-20 09:34:15 +02:00
isci
scsi: isci: Use the proper SCSI midlayer interfaces for PI
2021-08-11 22:25:43 -04:00
libfc
scsi: libfc: Fix use after free in fc_exch_abts_resp()
2022-04-13 20:59:08 +02:00
libsas
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
2022-10-26 12:35:15 +02:00
lpfc
scsi: lpfc: Rework MIB Rx Monitor debug info logic
2022-11-10 18:15:24 +01:00
megaraid
scsi: megaraid_sas: Fix double kfree()
2022-09-15 11:30:00 +02:00
mpi3mr
scsi: mpi3mr: Fix memory leaks
2022-04-13 20:59:05 +02:00
mpt3sas
scsi: mpt3sas: Fix return value check of dma_get_required_mask()
2022-09-28 11:11:48 +02:00
mvsas
scsi: mvsas: Add PCI ID of RocketRaid 2640
2022-04-20 09:34:17 +02:00
pcmcia
scsi: fdomain: Fix error return code in fdomain_probe()
2021-08-09 23:30:25 -04:00
pm8001
scsi: pm80xx: Enable upper inbound, outbound queues
2022-04-20 09:34:11 +02:00
qedf
scsi: qedf: Populate sysfs attributes for vport
2022-10-26 12:34:26 +02:00
qedi
scsi: iscsi: Fix session removal on shutdown
2022-08-17 14:23:45 +02:00
qla2xxx
scsi: qla2xxx: Use transport-defined speed mask for supported_speeds
2022-11-03 23:59:12 +09:00
qla4xxx
scsi: qla4xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:41 -04:00
smartpqi
scsi: smartpqi: Fix DMA direction for RAID requests
2022-08-17 14:23:51 +02:00
snic
scsi: snic: Fix spelling mistake 'progres' -> 'progress'
2021-08-24 22:56:32 -04:00
sym53c8xx_2
scsi: sym53c8xx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:42 -04:00
ufs
scsi: ufs: core: Reduce the power mode change timeout
2022-09-15 11:30:01 +02:00
.gitignore
.gitignore: add SPDX License Identifier
2020-03-25 11:50:48 +01:00
3w-9xxx.c
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
2022-10-26 12:35:46 +02:00
3w-9xxx.h
scsi: 3w-9xxx: Fix endianness issues in command packets
2021-05-15 18:01:34 -04:00
3w-sas.c
scsi: 3w-sas: Remove unneeded variable 'retval'
2021-03-18 22:18:09 -04:00
3w-sas.h
scsi: 3w-sas: Whitespace cleanup
2021-01-22 21:14:08 -05:00
3w-xxxx.c
scsi: core: Drop obsolete Linux-specific SCSI status codes
2021-05-31 23:59:18 -04:00
3w-xxxx.h
scsi: 3w-xxxx: Whitespace cleanup
2021-01-22 21:14:07 -05:00
53c700_d.h_shipped
…
53c700.c
scsi: 53c700: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:38 -04:00
53c700.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
53c700.scr
…
a100u2w.c
scsi: a100u2w: Remove unused variable biosaddr
2021-03-29 23:33:06 -04:00
a100u2w.h
…
a2091.c
mm: don't include asm/pgtable.h if linux/mm.h is already included
2020-06-09 09:39:13 -07:00
a2091.h
…
a3000.c
mm: don't include asm/pgtable.h if linux/mm.h is already included
2020-06-09 09:39:13 -07:00
a3000.h
…
a4000t.c
…
advansys.c
scsi: advansys: Fix kernel pointer leak
2021-11-25 09:48:27 +01:00
aha152x.c
scsi: aha152x: Fix aha152x_setup() __setup handler return value
2022-04-13 20:59:07 +02:00
aha152x.h
…
aha1542.c
scsi: aha1542: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:38 -04:00
aha1542.h
scsi: aha1542: Clarify 'struct ccb' comments
2021-01-13 00:14:07 -05:00
aha1740.c
scsi: aha1740: Avoid over-read of sense buffer
2021-06-18 23:27:04 -04:00
aha1740.h
…
am53c974.c
…
atari_scsi.c
scsi: atari_scsi: Fix race condition between .queuecommand and EH
2020-11-23 22:12:09 -05:00
atp870u.c
scsi: atp870u: Fix naming and demote incorrect and non-conformant kernel-doc header
2021-03-15 22:29:00 -04:00
atp870u.h
scsi: atp870u: Whitespace cleanup
2021-01-22 21:14:08 -05:00
BusLogic.c
scsi: BusLogic: Use %X for u32 sized integer rather than %lX
2021-08-01 13:27:46 -04:00
BusLogic.h
scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
2021-05-14 22:19:04 -04:00
bvme6000_scsi.c
…
ch.c
scsi: scsi_ioctl: Call scsi_cmd_ioctl() from scsi_ioctl()
2021-07-28 22:24:25 -04:00
constants.c
scsi: core: Introduce enums for the SAM and host status codes
2021-06-02 23:09:39 -04:00
dc395x.c
scsi: dc395x: Fix a missing check on list iterator
2022-06-09 10:23:22 +02:00
dc395x.h
scsi: dc395x: Drop internal SCSI message definitions
2021-01-22 21:14:10 -05:00
dmx3191d.c
…
dpt_i2o.c
scsi: dpt_i2o: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:38 -04:00
dpti.h
scsi: docs: convert dpti.txt to ReST
2020-03-11 23:07:59 -04:00
esp_scsi.c
scsi: core: Kill DRIVER_SENSE
2021-05-31 22:48:21 -04:00
esp_scsi.h
scsi: esp_scsi: Add support for FSC chip
2019-12-19 22:08:51 -05:00
fdomain_isa.c
isa: Make the remove callback for isa drivers return void
2021-01-26 07:42:27 +01:00
fdomain_pci.c
…
fdomain.c
scsi: fdomain: Translate message to host byte status
2021-05-31 22:48:24 -04:00
fdomain.h
scsi: fdomain: Mark 'fdomain_pm_ops' as __maybe_unused
2020-07-08 01:12:44 -04:00
FlashPoint.c
Merge branch '5.14/scsi-result' into 5.14/scsi-staging
2021-06-02 01:37:04 -04:00
g_NCR5380.c
isa: Make the remove callback for isa drivers return void
2021-01-26 07:42:27 +01:00
gvp11.c
mm: don't include asm/pgtable.h if linux/mm.h is already included
2020-06-09 09:39:13 -07:00
gvp11.h
…
hosts.c
scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run
2021-11-18 19:15:51 +01:00
hpsa_cmd.h
scsi: hpsa: Add an assert to prevent __packed reintroduction
2021-04-01 22:52:40 -04:00
hpsa.c
scsi: hpsa: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:39 -04:00
hpsa.h
scsi: hpsa: Update copyright
2020-09-02 22:49:06 -04:00
hptiop.c
scsi: core: Do not use DRIVER_INVALID
2021-05-31 22:48:21 -04:00
hptiop.h
…
imm.c
scsi: imm: Switch to use module_parport_driver()
2021-06-18 23:01:03 -04:00
imm.h
…
initio.c
scsi: initio: Fix a few kernel-doc misdemeanours
2021-03-18 23:35:55 -04:00
initio.h
scsi: initio: Drop internal SCSI message definition
2021-01-22 21:14:10 -05:00
ipr.c
scsi: ipr: Fix missing/incorrect resource cleanup in error case
2022-06-22 14:21:57 +02:00
ipr.h
scsi: ipr: System crashes when seeing type 20 error
2021-06-29 16:46:08 -04:00
ips.c
scsi: ips: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:39 -04:00
ips.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
iscsi_boot_sysfs.c
scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
2020-06-02 21:23:47 -04:00
iscsi_tcp.c
scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
2022-10-26 12:35:16 +02:00
iscsi_tcp.h
scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
2022-10-26 12:35:16 +02:00
jazz_esp.c
scsi: jazz_esp: Add IRQ check
2021-04-13 00:20:48 -04:00
Kconfig
scsi: core: Rename CONFIG_BLK_SCSI_REQUEST to CONFIG_SCSI_COMMON
2021-07-28 22:24:27 -04:00
lasi700.c
parisc: Make struct parisc_driver::remove() return void
2021-08-30 10:18:25 +02:00
libiscsi_tcp.c
scsi: iscsi: Merge suspend fields
2022-04-27 14:38:56 +02:00
libiscsi.c
scsi: iscsi: Add recv workqueue helpers
2022-10-26 12:35:15 +02:00
mac53c94.c
scsi: mac53c94: Fix warning comparing pointer to 0
2021-03-24 22:16:12 -04:00
mac53c94.h
…
mac_esp.c
scsi: mac_esp: Use module_platform_driver to simplify the code
2020-10-02 21:52:53 -04:00
mac_scsi.c
scsi: NCR5380: Remove context check
2020-12-07 20:24:09 -05:00
Makefile
scsi: core: Fix missing FORCE for scsi_devinfo_tbl.c build rule
2021-08-23 23:07:05 -04:00
megaraid.c
scsi: megaraid: Fix error check return value of register_chrdev()
2022-06-09 10:22:34 +02:00
megaraid.h
…
mesh.c
scsi: mesh: Translate message to host byte status
2021-05-31 22:48:23 -04:00
mesh.h
…
mvme16x_scsi.c
…
mvme147.c
mm: don't include asm/pgtable.h if linux/mm.h is already included
2020-06-09 09:39:13 -07:00
mvme147.h
…
mvumi.c
scsi: mvumi: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:40 -04:00
mvumi.h
scsi: Replace zero-length array with flexible-array member
2020-03-11 23:07:56 -04:00
myrb.c
scsi: myrb: Fix up null pointer access on myrb_cleanup()
2022-06-14 18:36:22 +02:00
myrb.h
scsi: mylex: Use the correct style for SPDX License Identifier
2020-01-02 21:57:44 -05:00
myrs.c
scsi: myrs: Fix crash in error case
2022-02-16 12:56:14 +01:00
myrs.h
scsi: mylex: Use the correct style for SPDX License Identifier
2020-01-02 21:57:44 -05:00
ncr53c8xx.c
scsi: ncr53c8xx: Remove unused retrieve_from_waiting_list() function
2021-09-13 22:15:47 -04:00
ncr53c8xx.h
scsi: ncr53c8xx: Use SAM status values
2021-01-22 21:14:12 -05:00
NCR5380.c
scsi: NCR5380: Use sc_data_direction instead of rq_data_dir()
2021-08-11 22:25:38 -04:00
NCR5380.h
scsi: NCR5380: Remove context check
2020-12-07 20:24:09 -05:00
nsp32_debug.c
…
nsp32_io.h
…
nsp32.c
scsi: nsp32: Do not set message byte
2021-05-31 22:48:23 -04:00
nsp32.h
…
pmcraid.c
scsi: pmcraid: Fix missing resource cleanup in error case
2022-06-22 14:21:57 +02:00
pmcraid.h
scsi: pmcraid: Fix typos
2021-05-21 16:59:33 -04:00
ppa.c
scsi: ppa: Switch to use module_parport_driver()
2021-06-18 23:01:03 -04:00
ppa.h
…
ps3rom.c
scsi: core: Introduce scsi_build_sense()
2021-05-31 22:48:21 -04:00
qla1280.c
scsi: qla1280: Stop using scsi_cmnd.tag
2021-08-23 23:06:56 -04:00
qla1280.h
scsi: qla1280: Fix dma firmware download, if dma address is 64bit
2020-01-15 23:09:11 -05:00
qlogicfas408.c
scsi: qlogicfas408: Whitespace cleanup
2021-05-31 22:48:23 -04:00
qlogicfas408.h
…
qlogicfas.c
…
qlogicpti.c
scsi: qlogicpti: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:41 -04:00
qlogicpti.h
…
raid_class.c
…
script_asm.pl
…
scsi_bsg.c
scsi: bsg: Fix commands without data transfer in scsi_bsg_sg_io_fn()
2021-08-01 13:21:40 -04:00
scsi_common.c
scsi: core: Rename CONFIG_BLK_SCSI_REQUEST to CONFIG_SCSI_COMMON
2021-07-28 22:24:27 -04:00
scsi_debug.c
scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
2022-11-26 09:24:50 +01:00
scsi_debugfs.c
scsi: core: Show SCMD_LAST in text form
2022-01-27 11:05:22 +01:00
scsi_debugfs.h
…
scsi_devinfo.c
scsi: core: Add BLIST_IGN_MEDIA_CHANGE for Ultra HS-SD/MMC USB card readers
2021-07-21 23:49:02 -04:00
scsi_dh.c
scsi: scsi_dh: Fix a typo
2021-03-24 23:03:43 -04:00
scsi_error.c
scsi: core: sd: Add silence_suspend flag to suppress some PM messages
2022-04-08 14:22:54 +02:00
scsi_ioctl.c
scsi: core: Fix warning in scsi_alloc_sgtables()
2022-08-03 12:03:47 +02:00
scsi_lib_dma.c
…
scsi_lib.c
scsi: core: Fix scsi_mode_sense() buffer length handling
2021-11-25 09:48:26 +01:00
scsi_logging.c
scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:37 -04:00
scsi_logging.h
scsi: core: Fix a compiler warning triggered by the SCSI logging code
2019-12-19 22:08:54 -05:00
scsi_netlink.c
…
scsi_pm.c
scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()
2022-01-27 11:04:15 +01:00
scsi_priv.h
scsi: bsg: Simplify device registration
2021-07-30 22:22:36 -04:00
scsi_proc.c
proc: convert everything to "struct proc_ops"
2020-02-04 03:05:26 +00:00
scsi_sas_internal.h
…
scsi_scan.c
scsi: core: Fix sbitmap depth in scsi_realloc_sdev_budget_map()
2022-04-13 20:59:15 +02:00
scsi_sysctl.c
…
scsi_sysfs.c
scsi: core: Restrict legal sdev_state transitions via sysfs
2022-11-10 18:15:34 +01:00
scsi_trace.c
scsi: scsi_trace: Use get_unaligned_be24()
2020-03-16 22:08:36 -04:00
scsi_transport_api.h
…
scsi_transport_fc.c
scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters
2022-04-08 14:22:54 +02:00
scsi_transport_iscsi.c
scsi: iscsi: Add helper to remove a session from the kernel
2022-08-17 14:23:44 +02:00
scsi_transport_sas.c
scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
2022-11-26 09:24:35 +01:00
scsi_transport_spi.c
scsi: scsi_transport_spi: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:37 -04:00
scsi_transport_srp.c
scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
2021-04-05 23:14:53 -04:00
scsi.c
scsi: core: Fix scsi_device_max_queue_depth()
2022-01-27 11:04:10 +01:00
scsi.h
…
scsicam.c
include: remove pagemap.h from blkdev.h
2021-05-06 19:24:11 -07:00
sd_dif.c
…
sd_zbc.c
scsi: sd_zbc: Support disks with more than 2**32 logical blocks
2021-09-21 23:52:55 -04:00
sd.c
scsi: sd: Revert "scsi: sd: Remove a local variable"
2022-11-03 23:59:20 +09:00
sd.h
SCSI misc on 20201013
2020-10-14 15:15:35 -07:00
sense_codes.h
scsi: core: Update additional sense codes list
2020-09-15 20:28:06 -04:00
ses.c
scsi: ses: Fix unsigned comparison with less than zero
2021-09-28 22:42:06 -04:00
sg.c
scsi: sg: Allow waiting for commands to complete on removed device
2022-08-17 14:22:55 +02:00
sgiwd93.c
sgiwd93: convert to dma_alloc_noncoherent
2020-09-25 06:20:44 +02:00
sim710.c
scsi: sim710: Remove unused variable 'err' from sim710_init()
2021-03-18 22:52:29 -04:00
sni_53c710.c
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
sr_ioctl.c
scsi: sr: Do not leak information in ioctl
2022-04-27 14:38:58 +02:00
sr_vendor.c
scsi: sr: Don't use GFP_DMA
2022-01-27 11:05:03 +01:00
sr.c
scsi: sr: Fix typo in CDROM(CLOSETRAY|EJECT) handling
2022-04-13 20:59:15 +02:00
sr.h
scsi: sr: get rid of sr global mutex
2020-02-24 15:01:57 -05:00
st_options.h
…
st.c
block: drop unused includes in <linux/genhd.h>
2022-03-16 14:23:46 +01:00
st.h
st: do not allocate a gendisk
2021-08-23 12:54:30 -06:00
stex.c
scsi: stex: Properly zero out the passthrough command structure
2022-10-15 07:59:01 +02:00
storvsc_drv.c
scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
2022-08-31 17:16:51 +02:00
sun3_scsi_vme.c
…
sun3_scsi.c
scsi: sun3_scsi: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
2021-08-11 22:25:41 -04:00
sun3x_esp.c
scsi: sun3x_esp: Add IRQ check
2021-04-13 00:20:48 -04:00
sun_esp.c
scsi: sun_esp: Use module_platform_driver to simplify the code
2020-10-02 21:52:55 -04:00
virtio_scsi.c
scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
2021-09-28 22:47:28 -04:00
vmw_pvscsi.c
scsi: vmw_pvscsi: Set residual data length conditionally
2022-01-05 12:42:39 +01:00
vmw_pvscsi.h
scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
2022-06-22 14:21:57 +02:00
wd33c93.c
scsi: wd33c93: Translate message byte to host byte
2021-05-31 22:48:23 -04:00
wd33c93.h
…
wd719x.c
scsi: wd719: Stop using scsi_cmnd.tag
2021-08-16 13:33:24 -04:00
wd719x.h
…
xen-scsifront.c
xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
2022-03-11 12:22:36 +01:00
zalon.c
parisc: Make struct parisc_driver::remove() return void
2021-08-30 10:18:25 +02:00
zorro7xx.c
scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
2022-04-13 20:59:15 +02:00
zorro_esp.c
mm: reorder includes after introduction of linux/pgtable.h
2020-06-09 09:39:13 -07:00