scsi: qla4xxx: Fix use after free bug in da9150_charger_remove due to race condition
Message ID | 20230309183812.299349-1-zyytlz.wz@163.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp457905wrd; Thu, 9 Mar 2023 10:51:35 -0800 (PST) X-Google-Smtp-Source: AK7set/pY6ZjYOWSwcvQ+JHK1izCm6cvgJ/QSNHBHtX8ExzFnaOWe/tKMK9RaUP5xSlrwcv6RUWS X-Received: by 2002:a17:903:1c1:b0:19e:6700:174 with SMTP id e1-20020a17090301c100b0019e67000174mr27984405plh.25.1678387895076; Thu, 09 Mar 2023 10:51:35 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678387895; cv=none; d=google.com; s=arc-20160816; b=wiHnFPsIGxsnDVG0BUpInlnuTfAaf5Lwm9IFut17tqEFPOjLGBK9PicWa4MzS4Eorg 1JbE1ypHLpMY2k4wv/MMxZ9qLrG0h/xbgrIkdtnHqDho5l7HDuEtysI0dh6tC9rIxCQj aT1zmFQ170lwdBD7wpzCjCgrHJb2ZUN6AVCa3gyq8XEuwbPBq0Dgb4TZNCfsjIaLvAvH nZb5rYVrhTPsCQLbh2vvChEDwQZz/EBYPdasRKNnUOAwZRKYmyAM7T0yuIeFkhVrfgGq PZL4N/Gza+bU2uPghKn1xRFmtAXQLmjPY8oOGeOymAwudHNChw4DBiXe/3r9flPtAWn6 z1xQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=LmXrypUhkfQZNqHBXt/FnFD1GHWz24KdFa4arN1jaDs=; b=bKJGv8v17FFUDESuZF/mPhQL4nIqhjTfR4P80ha14EP02Pa71dpbZo2QjvdZkFWB4S nKSusqhLzw6AfqLIb1jnjEUnxgdq+oPKe7/kKbs3qvGxudBGs/fBJP/ahdMC30T5aig5 h89P1j69DriPE02iQFoHObne2HdEZvMxlci1qmx+UymGdPLpc4jsKRPSsEXYz8TgRyVu +Z94tme0AGvIhOWfd/Hexjry631nxCOe4dtRG2BDfbX2lKDGBM4h6dKt1Sez8Ytl78OW tneZhQnCicm/I4ylB5xKvcOe49zEptgOCyBH2Bpak0FP29TZd82PVOzkVI1sIIByCW8h gv1A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=OeGEkv9b; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c5-20020a170903234500b0019a7ef5e9acsi6836plh.305.2023.03.09.10.51.20; Thu, 09 Mar 2023 10:51:35 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=OeGEkv9b; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230119AbjCISib (ORCPT <rfc822;toshivichauhan@gmail.com> + 99 others); Thu, 9 Mar 2023 13:38:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43480 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229870AbjCISia (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 9 Mar 2023 13:38:30 -0500 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.199]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id CDF7FF16BD; Thu, 9 Mar 2023 10:38:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=LmXry pUhkfQZNqHBXt/FnFD1GHWz24KdFa4arN1jaDs=; b=OeGEkv9b2LimBM9xgXpwk olYySl+AaRQp/4TBZNoRWsvyDb4bS3atoHeRy5n+BunTBSemigD1Iv08CO+eS1rw mDPXgA717P625BEjaXGNYbaZpi7F/Kohtam2Mi0n6YQhQqM8AHLa4YXpwLpdfk7x 3n8Pp/UUoJCdUNI0ZAbvIk= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by zwqz-smtp-mta-g2-0 (Coremail) with SMTP id _____wCXBZ6VJwpkAS33Cg--.7263S2; Fri, 10 Mar 2023 02:38:13 +0800 (CST) From: Zheng Wang <zyytlz.wz@163.com> To: njavali@marvell.com Cc: mrangankar@marvell.com, GR-QLogic-Storage-Upstream@marvell.com, jejb@linux.ibm.com, martin.petersen@oracle.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, hackerzheng666@gmail.com, 1395428693sheep@gmail.com, alex000young@gmail.com, Zheng Wang <zyytlz.wz@163.com> Subject: [PATCH] scsi: qla4xxx: Fix use after free bug in da9150_charger_remove due to race condition Date: Fri, 10 Mar 2023 02:38:12 +0800 Message-Id: <20230309183812.299349-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID: _____wCXBZ6VJwpkAS33Cg--.7263S2 X-Coremail-Antispam: 1Uf129KBjvdXoWrKFyUKw1xtw4rAr1UWFy3Jwb_yoWkWrX_C3 yqvryxKr1aqr4kKr17Xr13ArWxWF4kXF90kFyrtF13AFy5uwn3X3yDuFZ0vw4UG39FyFy3 Cw1jyrW5Zrn8KjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7xRMwZ2DUUUUU== X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiQhctU1aEEmt7MAAAsL X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759917265387859092?= X-GMAIL-MSGID: =?utf-8?q?1759917265387859092?= |
Series |
scsi: qla4xxx: Fix use after free bug in da9150_charger_remove due to race condition
|
|
Commit Message
Zheng Wang
March 9, 2023, 6:38 p.m. UTC
In qla4xxx_probe_adapter, &ha->dpc_work is bound with
qla4xxx_do_dpc. qla4xxx_post_aen_work may be called
to start the work.
If we remove the module which will call qla4xxx_remove_adapter
to make cleanup, there may be a unfinished work. The possible
sequence is as follows:
Fix it by canceling the work before cleanup in qla4xxx_remove_adapter
CPU0 CPUc1
|qla4xxx_do_dpc
qla4xxx_remove_adapter|
scsi_remove_host |
kfree(ha->host) |
|
| iscsi_host_for_each_session
| //use ha->host
Fixes: afaf5a2d341d ("[SCSI] Initial Commit of qla4xxx")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
drivers/scsi/qla4xxx/ql4_os.c | 1 +
1 file changed, 1 insertion(+)
Comments
Sorry about the fix. This is a false positive which should be ignored. The work will be posted on ha->dpc_thread. In qla4xxx_remove_adapter, it will call destroy_workqueue(ha->dpc_thread); Regards, Zheng Zheng Wang <zyytlz.wz@163.com> 于2023年3月10日周五 02:38写道: > > In qla4xxx_probe_adapter, &ha->dpc_work is bound with > qla4xxx_do_dpc. qla4xxx_post_aen_work may be called > to start the work. > > If we remove the module which will call qla4xxx_remove_adapter > to make cleanup, there may be a unfinished work. The possible > sequence is as follows: > > Fix it by canceling the work before cleanup in qla4xxx_remove_adapter > > CPU0 CPUc1 > > |qla4xxx_do_dpc > qla4xxx_remove_adapter| > scsi_remove_host | > kfree(ha->host) | > | > | iscsi_host_for_each_session > | //use ha->host > Fixes: afaf5a2d341d ("[SCSI] Initial Commit of qla4xxx") > Signed-off-by: Zheng Wang <zyytlz.wz@163.com> > --- > drivers/scsi/qla4xxx/ql4_os.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c > index 005502125b27..d530cc853f43 100644 > --- a/drivers/scsi/qla4xxx/ql4_os.c > +++ b/drivers/scsi/qla4xxx/ql4_os.c > @@ -9001,6 +9001,7 @@ static void qla4xxx_remove_adapter(struct pci_dev *pdev) > if (!pci_is_enabled(pdev)) > return; > > + cancel_work_sync(&ha->dpc_work); > ha = pci_get_drvdata(pdev); > > if (is_qla40XX(ha)) > -- > 2.25.1 >
Hi Zheng, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on mkp-scsi/for-next] [also build test WARNING on jejb-scsi/for-next linus/master v6.3-rc1 next-20230309] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Zheng-Wang/scsi-qla4xxx-Fix-use-after-free-bug-in-da9150_charger_remove-due-to-race-condition/20230310-024016 base: https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next patch link: https://lore.kernel.org/r/20230309183812.299349-1-zyytlz.wz%40163.com patch subject: [PATCH] scsi: qla4xxx: Fix use after free bug in da9150_charger_remove due to race condition config: s390-randconfig-r044-20230308 (https://download.01.org/0day-ci/archive/20230310/202303100523.6OSGFoVE-lkp@intel.com/config) compiler: clang version 17.0.0 (https://github.com/llvm/llvm-project 67409911353323ca5edf2049ef0df54132fa1ca7) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install s390 cross compiling tool for clang build # apt-get install binutils-s390x-linux-gnu # https://github.com/intel-lab-lkp/linux/commit/f5410be5e51edb79365b3e0be8c80e4ff34e7e50 git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Zheng-Wang/scsi-qla4xxx-Fix-use-after-free-bug-in-da9150_charger_remove-due-to-race-condition/20230310-024016 git checkout f5410be5e51edb79365b3e0be8c80e4ff34e7e50 # save the config file mkdir build_dir && cp config build_dir/.config COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=s390 olddefconfig COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=s390 SHELL=/bin/bash drivers/scsi/qla4xxx/ If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot <lkp@intel.com> | Link: https://lore.kernel.org/oe-kbuild-all/202303100523.6OSGFoVE-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/scsi/qla4xxx/ql4_os.c:10: In file included from include/linux/inet.h:42: In file included from include/net/net_namespace.h:43: In file included from include/linux/skbuff.h:28: In file included from include/linux/dma-mapping.h:10: In file included from include/linux/scatterlist.h:9: In file included from arch/s390/include/asm/io.h:75: include/asm-generic/io.h:547:31: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] val = __raw_readb(PCI_IOBASE + addr); ~~~~~~~~~~ ^ include/asm-generic/io.h:560:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] val = __le16_to_cpu((__le16 __force)__raw_readw(PCI_IOBASE + addr)); ~~~~~~~~~~ ^ include/uapi/linux/byteorder/big_endian.h:37:59: note: expanded from macro '__le16_to_cpu' #define __le16_to_cpu(x) __swab16((__force __u16)(__le16)(x)) ^ include/uapi/linux/swab.h:102:54: note: expanded from macro '__swab16' #define __swab16(x) (__u16)__builtin_bswap16((__u16)(x)) ^ In file included from drivers/scsi/qla4xxx/ql4_os.c:10: In file included from include/linux/inet.h:42: In file included from include/net/net_namespace.h:43: In file included from include/linux/skbuff.h:28: In file included from include/linux/dma-mapping.h:10: In file included from include/linux/scatterlist.h:9: In file included from arch/s390/include/asm/io.h:75: include/asm-generic/io.h:573:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] val = __le32_to_cpu((__le32 __force)__raw_readl(PCI_IOBASE + addr)); ~~~~~~~~~~ ^ include/uapi/linux/byteorder/big_endian.h:35:59: note: expanded from macro '__le32_to_cpu' #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x)) ^ include/uapi/linux/swab.h:115:54: note: expanded from macro '__swab32' #define __swab32(x) (__u32)__builtin_bswap32((__u32)(x)) ^ In file included from drivers/scsi/qla4xxx/ql4_os.c:10: In file included from include/linux/inet.h:42: In file included from include/net/net_namespace.h:43: In file included from include/linux/skbuff.h:28: In file included from include/linux/dma-mapping.h:10: In file included from include/linux/scatterlist.h:9: In file included from arch/s390/include/asm/io.h:75: include/asm-generic/io.h:584:33: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] __raw_writeb(value, PCI_IOBASE + addr); ~~~~~~~~~~ ^ include/asm-generic/io.h:594:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] __raw_writew((u16 __force)cpu_to_le16(value), PCI_IOBASE + addr); ~~~~~~~~~~ ^ include/asm-generic/io.h:604:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] __raw_writel((u32 __force)cpu_to_le32(value), PCI_IOBASE + addr); ~~~~~~~~~~ ^ include/asm-generic/io.h:692:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] readsb(PCI_IOBASE + addr, buffer, count); ~~~~~~~~~~ ^ include/asm-generic/io.h:700:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] readsw(PCI_IOBASE + addr, buffer, count); ~~~~~~~~~~ ^ include/asm-generic/io.h:708:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] readsl(PCI_IOBASE + addr, buffer, count); ~~~~~~~~~~ ^ include/asm-generic/io.h:717:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] writesb(PCI_IOBASE + addr, buffer, count); ~~~~~~~~~~ ^ include/asm-generic/io.h:726:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] writesw(PCI_IOBASE + addr, buffer, count); ~~~~~~~~~~ ^ include/asm-generic/io.h:735:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] writesl(PCI_IOBASE + addr, buffer, count); ~~~~~~~~~~ ^ >> drivers/scsi/qla4xxx/ql4_os.c:9004:20: warning: variable 'ha' is uninitialized when used here [-Wuninitialized] cancel_work_sync(&ha->dpc_work); ^~ drivers/scsi/qla4xxx/ql4_os.c:8995:26: note: initialize the variable 'ha' to silence this warning struct scsi_qla_host *ha; ^ = NULL 13 warnings generated. vim +/ha +9004 drivers/scsi/qla4xxx/ql4_os.c 8963 8964 static void qla4xxx_destroy_fw_ddb_session(struct scsi_qla_host *ha) 8965 { 8966 struct ddb_entry *ddb_entry; 8967 int idx; 8968 8969 for (idx = 0; idx < MAX_DDB_ENTRIES; idx++) { 8970 8971 ddb_entry = qla4xxx_lookup_ddb_by_fw_index(ha, idx); 8972 if ((ddb_entry != NULL) && 8973 (ddb_entry->ddb_type == FLASH_DDB)) { 8974 8975 qla4xxx_destroy_ddb(ha, ddb_entry); 8976 /* 8977 * we have decremented the reference count of the driver 8978 * when we setup the session to have the driver unload 8979 * to be seamless without actually destroying the 8980 * session 8981 **/ 8982 try_module_get(qla4xxx_iscsi_transport.owner); 8983 iscsi_destroy_endpoint(ddb_entry->conn->ep); 8984 qla4xxx_free_ddb(ha, ddb_entry); 8985 iscsi_session_teardown(ddb_entry->sess); 8986 } 8987 } 8988 } 8989 /** 8990 * qla4xxx_remove_adapter - callback function to remove adapter. 8991 * @pdev: PCI device pointer 8992 **/ 8993 static void qla4xxx_remove_adapter(struct pci_dev *pdev) 8994 { 8995 struct scsi_qla_host *ha; 8996 8997 /* 8998 * If the PCI device is disabled then it means probe_adapter had 8999 * failed and resources already cleaned up on probe_adapter exit. 9000 */ 9001 if (!pci_is_enabled(pdev)) 9002 return; 9003 > 9004 cancel_work_sync(&ha->dpc_work); 9005 ha = pci_get_drvdata(pdev); 9006 9007 if (is_qla40XX(ha)) 9008 qla4xxx_prevent_other_port_reinit(ha); 9009 9010 /* destroy iface from sysfs */ 9011 qla4xxx_destroy_ifaces(ha); 9012 9013 if ((!ql4xdisablesysfsboot) && ha->boot_kset) 9014 iscsi_boot_destroy_kset(ha->boot_kset); 9015 9016 qla4xxx_destroy_fw_ddb_session(ha); 9017 qla4_8xxx_free_sysfs_attr(ha); 9018 9019 qla4xxx_sysfs_ddb_remove(ha); 9020 scsi_remove_host(ha->host); 9021 9022 qla4xxx_free_adapter(ha); 9023 9024 scsi_host_put(ha->host); 9025 9026 pci_disable_pcie_error_reporting(pdev); 9027 pci_disable_device(pdev); 9028 } 9029
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index 005502125b27..d530cc853f43 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -9001,6 +9001,7 @@ static void qla4xxx_remove_adapter(struct pci_dev *pdev) if (!pci_is_enabled(pdev)) return; + cancel_work_sync(&ha->dpc_work); ha = pci_get_drvdata(pdev); if (is_qla40XX(ha))