|
 |
3c6e85 |
From 6e7fb2024250405d737e56985d6a86282f1175c4 Mon Sep 17 00:00:00 2001
|
|
|
3c6e85 |
From: Himanshu Madhani <hmadhani@redhat.com>
|
|
|
3c6e85 |
Date: Thu, 1 Aug 2019 15:55:51 -0400
|
|
|
3c6e85 |
Subject: [PATCH 091/124] [scsi] scsi: qla2xxx: Fix use-after-free issues in
|
|
|
3c6e85 |
qla2xxx_qpair_sp_free_dma()
|
|
|
3c6e85 |
|
|
|
3c6e85 |
Message-id: <20190801155618.12650-92-hmadhani@redhat.com>
|
|
|
3c6e85 |
Patchwork-id: 267868
|
|
|
3c6e85 |
O-Subject: [RHEL 7.8 e-stor PATCH 091/118] scsi: qla2xxx: Fix use-after-free issues in qla2xxx_qpair_sp_free_dma()
|
|
|
3c6e85 |
Bugzilla: 1729270
|
|
|
3c6e85 |
RH-Acked-by: Jarod Wilson <jarod@redhat.com>
|
|
|
3c6e85 |
RH-Acked-by: Tony Camuso <tcamuso@redhat.com>
|
|
|
3c6e85 |
|
|
|
3c6e85 |
From: Bart Van Assche <bvanassche@acm.org>
|
|
|
3c6e85 |
|
|
|
3c6e85 |
Bugzilla 1729270
|
|
|
3c6e85 |
|
|
|
3c6e85 |
The current order for freeing memory is as follows:
|
|
|
3c6e85 |
- struct crc_context itself.
|
|
|
3c6e85 |
- struct crc_context member pointers.
|
|
|
3c6e85 |
|
|
|
3c6e85 |
Change the freeing order into the following:
|
|
|
3c6e85 |
- struct crc_context member pointers.
|
|
|
3c6e85 |
- struct crc_context itself.
|
|
|
3c6e85 |
|
|
|
3c6e85 |
Detected by Coverity.
|
|
|
3c6e85 |
|
|
|
3c6e85 |
Cc: Himanshu Madhani <hmadhani@marvell.com>
|
|
|
3c6e85 |
Cc: Giridhar Malavali <gmalavali@marvell.com>
|
|
|
3c6e85 |
Fixes: 50b812755e97 ("scsi: qla2xxx: Fix DMA error when the DIF sg buffer crosses 4GB boundary") # v5.1-rc1.
|
|
|
3c6e85 |
Fixes: d74595278f4a ("scsi: qla2xxx: Add multiple queue pair functionality.") # v4.10.
|
|
|
3c6e85 |
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
|
|
|
3c6e85 |
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
|
|
|
3c6e85 |
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
|
|
|
3c6e85 |
(cherry picked from commit d8f945bf8096375f458683b5718722a2d5dda2f0)
|
|
|
3c6e85 |
Signed-off-by: Himanshu Madhani <hmadhani@redhat.com>
|
|
|
3c6e85 |
|
|
|
3c6e85 |
Conflicts:
|
|
|
3c6e85 |
drivers/scsi/qla2xxx/qla_os.c
|
|
|
3c6e85 |
|
|
|
3c6e85 |
[ HM: RHEL7.8 kernel does not have wait_event_lock_irq_timeout() ]
|
|
|
3c6e85 |
[ commit 711a08d79f71 ("scsi: qla2xxx: Change abort wait_loop ]
|
|
|
3c6e85 |
[ from msleep to wait_event_timeout") was not pulled into src ]
|
|
|
3c6e85 |
[ resulting into deviation from upstream ]
|
|
|
3c6e85 |
|
|
|
3c6e85 |
Signed-off-by: Himanshu Madhani <hmadhani@redhat.com>
|
|
|
3c6e85 |
Signed-off-by: Jan Stancek <jstancek@redhat.com>
|
|
|
3c6e85 |
---
|
|
|
3c6e85 |
drivers/scsi/qla2xxx/qla_os.c | 38 ++++++++++++++++++++------------------
|
|
|
3c6e85 |
1 file changed, 20 insertions(+), 18 deletions(-)
|
|
|
3c6e85 |
|
|
|
3c6e85 |
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
|
|
|
3c6e85 |
index 83d06db7e9fa..bc72d4802844 100644
|
|
|
3c6e85 |
--- a/drivers/scsi/qla2xxx/qla_os.c
|
|
|
3c6e85 |
+++ b/drivers/scsi/qla2xxx/qla_os.c
|
|
|
3c6e85 |
@@ -811,25 +811,8 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
|
|
|
3c6e85 |
sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
|
|
|
3c6e85 |
}
|
|
|
3c6e85 |
|
|
|
3c6e85 |
- if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
|
|
|
3c6e85 |
- struct crc_context *ctx0 = ctx;
|
|
|
3c6e85 |
-
|
|
|
3c6e85 |
- dma_pool_free(ha->dl_dma_pool, ctx, ctx0->crc_ctx_dma);
|
|
|
3c6e85 |
- sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
|
|
|
3c6e85 |
- }
|
|
|
3c6e85 |
-
|
|
|
3c6e85 |
- if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
|
|
|
3c6e85 |
- struct ct6_dsd *ctx1 = ctx;
|
|
|
3c6e85 |
- dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
|
|
|
3c6e85 |
- ctx1->fcp_cmnd_dma);
|
|
|
3c6e85 |
- list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
|
|
|
3c6e85 |
- ha->gbl_dsd_inuse -= ctx1->dsd_use_cnt;
|
|
|
3c6e85 |
- ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
|
|
|
3c6e85 |
- mempool_free(ctx1, ha->ctx_mempool);
|
|
|
3c6e85 |
- sp->flags &= ~SRB_FCP_CMND_DMA_VALID;
|
|
|
3c6e85 |
- }
|
|
|
3c6e85 |
if (sp->flags & SRB_DIF_BUNDL_DMA_VALID) {
|
|
|
3c6e85 |
- struct crc_context *difctx = sp->u.scmd.ctx;
|
|
|
3c6e85 |
+ struct crc_context *difctx = ctx;
|
|
|
3c6e85 |
struct dsd_dma *dif_dsd, *nxt_dsd;
|
|
|
3c6e85 |
|
|
|
3c6e85 |
list_for_each_entry_safe(dif_dsd, nxt_dsd,
|
|
|
3c6e85 |
@@ -864,6 +847,25 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
|
|
|
3c6e85 |
sp->flags &= ~SRB_DIF_BUNDL_DMA_VALID;
|
|
|
3c6e85 |
}
|
|
|
3c6e85 |
|
|
|
3c6e85 |
+ if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
|
|
|
3c6e85 |
+ struct ct6_dsd *ctx1 = ctx;
|
|
|
3c6e85 |
+
|
|
|
3c6e85 |
+ dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
|
|
|
3c6e85 |
+ ctx1->fcp_cmnd_dma);
|
|
|
3c6e85 |
+ list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
|
|
|
3c6e85 |
+ ha->gbl_dsd_inuse -= ctx1->dsd_use_cnt;
|
|
|
3c6e85 |
+ ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
|
|
|
3c6e85 |
+ mempool_free(ctx1, ha->ctx_mempool);
|
|
|
3c6e85 |
+ sp->flags &= ~SRB_FCP_CMND_DMA_VALID;
|
|
|
3c6e85 |
+ }
|
|
|
3c6e85 |
+
|
|
|
3c6e85 |
+ if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
|
|
|
3c6e85 |
+ struct crc_context *ctx0 = ctx;
|
|
|
3c6e85 |
+
|
|
|
3c6e85 |
+ dma_pool_free(ha->dl_dma_pool, ctx, ctx0->crc_ctx_dma);
|
|
|
3c6e85 |
+ sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
|
|
|
3c6e85 |
+ }
|
|
|
3c6e85 |
+
|
|
|
3c6e85 |
end:
|
|
|
3c6e85 |
CMD_SP(cmd) = NULL;
|
|
|
3c6e85 |
qla2xxx_rel_qpair_sp(sp->qpair, sp);
|
|
|
3c6e85 |
--
|
|
|
3c6e85 |
2.13.6
|
|
|
3c6e85 |
|