From patchwork Sun Mar 12 16:48:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Wang X-Patchwork-Id: 68396 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp797222wrd; Sun, 12 Mar 2023 09:58:37 -0700 (PDT) X-Google-Smtp-Source: AK7set/1nPJ3vdNwmBJidewUENIhFAqIkRHgTIyEMRzCuePvMnXXEwml3OuyDboTPUexM/5OKZ3X X-Received: by 2002:a17:903:283:b0:19e:72cb:ff83 with SMTP id j3-20020a170903028300b0019e72cbff83mr39256563plr.8.1678640317340; Sun, 12 Mar 2023 09:58:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1678640317; cv=none; d=google.com; s=arc-20160816; b=hxRM6fwi66yU53Hwna8bZ8xOdaickI31uQGO82rxNA9FyS4OSQyDPFKFtgEuE2r69N q6XrXwimKtDsGVnaBdqvYNKtJxK8qyCUCiyVjFtWGTuUtMUZf+qGc02RulLVqGvXO8IU 5Vs6DBFyF3o5y7PyKOtarXRCeQ+CwMPySpMBcGY5LaJd8mN0h1sLC6jKibtmSy7+5YAC znCURU8p3au/je/dSS/VQd7dy33gQ8GR5EE6ICj2rqPTtbLxW+MRFDIv2p7Rh5W9MSch SpATDtnCnKJid2WEG+9mzrkZbyVNhLBs0Q+Ulyqyy+n21qi/0J6MxIYlSyjaQF7qJHO7 eAzQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=N4jp8xAkv6nJvns9rj2xzYaBjm242kwG0b+7YqJ0+cc=; b=NH3p5G66vgZW5N/8InDstiAiUliu0qmkWfSFoD1Htma4lprKsF3us+6k+80qqK/p0m PwDksv3Xo2BX6exR04MXTiU9ADyahQzGu/RdkNK/zXLUJgs5Id3NfUw+3bnf3SK4GEkA 5dm6Sx8gctPaYuFsfr2qMd1opK1c/XcvgNe+w42STehDxHhZPObilgbTQz6EBe9upc9q g1JVhMS2fMGUF3nnbpCgeBdw3dJKCckrAdySWXO9Ui6/8y28nShLVnB1YTyF1PPrg/tz KedYNZUR/hSjAANsr5gtKDA9kTr2LSG7XILJiex64+mVQZFWGLFw42LFKUYOIdehb0ET UkbA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=d071C3qx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d4-20020a170903230400b0019e9849174fsi4821443plh.547.2023.03.12.09.58.25; Sun, 12 Mar 2023 09:58:37 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=d071C3qx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231150AbjCLQsc (ORCPT + 99 others); Sun, 12 Mar 2023 12:48:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33482 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229561AbjCLQsb (ORCPT ); Sun, 12 Mar 2023 12:48:31 -0400 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.197]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 3DE402200E; Sun, 12 Mar 2023 09:48:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=N4jp8 xAkv6nJvns9rj2xzYaBjm242kwG0b+7YqJ0+cc=; b=d071C3qxmpqpF+KJF9YpO m9SEjmPqRNt1HO5i9TEjrNXpcIJ++HSZU4HdTeE/3mOwq8Pv0aq5ceO00OYhrsMg gIhHYoiOhYgLypp7ASZz1USmM36j+XYcBZJbE/lDGbYmQ6QtQHWET9CfMjUlkzEK AeJbOPrELz/BHFMBaaT6Jo= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by zwqz-smtp-mta-g0-4 (Coremail) with SMTP id _____wD31E5IAg5k_rGRDA--.2593S2; Mon, 13 Mar 2023 00:48:08 +0800 (CST) From: Zheng Wang To: don.brace@microchip.com Cc: jejb@linux.ibm.com, martin.petersen@oracle.com, storagedev@microchip.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, hackerzheng666@gmail.com, 1395428693sheep@gmail.com, alex000young@gmail.com, Zheng Wang Subject: [PATCH] scsi: smartpqi: Fix use after free bug in pqi_pci_remove due to race condition Date: Mon, 13 Mar 2023 00:48:06 +0800 Message-Id: <20230312164806.2104140-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: _____wD31E5IAg5k_rGRDA--.2593S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7Aw1xCr1rXr1kXw4fGrWkXrb_yoW8Xr18pF 4fJ3sxCr45tryY9w1DA3W0yFy3Cay5KrW3Cwsrt343XF13CryjqryUCa1qvr43XFsYkr4Y yF1Fy3W5WFy7JFUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zi-J55UUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiXBAwU1Xl55jdsgAAsP X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,RCVD_IN_MSPIKE_H2, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1760181949489046897?= X-GMAIL-MSGID: =?utf-8?q?1760181949489046897?= In pqi_pci_probe, it calls pqi_alloc_ctrl_info and bound &ctrl_info->event_work with pqi_event_worker. When it calls pqi_irq_handler to handle IRQ, it will finally call schedule_work to start the work. When we call pqi_pci_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in pqi_remove_ctrl. CPU0 CPU1 |pqi_event_worker pqi_pci_remove | pqi_remove_ctrl | pqi_free_ctrl_resources| pqi_free_ctrl_info| kfree(ctrl_info) | //free ctrl_info | |pqi_ctrl_busy |//use ctrl_info Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver") Signed-off-by: Zheng Wang --- drivers/scsi/smartpqi/smartpqi_init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c index 49a8f91810b6..555f1af38f38 100644 --- a/drivers/scsi/smartpqi/smartpqi_init.c +++ b/drivers/scsi/smartpqi/smartpqi_init.c @@ -8939,6 +8939,7 @@ static void pqi_take_ctrl_offline_deferred(struct pqi_ctrl_info *ctrl_info) pqi_perform_lockup_action(); pqi_stop_heartbeat_timer(ctrl_info); pqi_free_interrupts(ctrl_info); + cancel_work_sync(&ctrl_info->event_work); pqi_cancel_rescan_worker(ctrl_info); pqi_cancel_update_time_worker(ctrl_info); pqi_ctrl_wait_until_quiesced(ctrl_info);