| Message ID | 20200827095829.63871-2-dwagner@suse.de (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | qla2xxx: A couple crash fixes | expand |
On Thu, 2020-08-27 at 11:58 +0200, Daniel Wagner wrote: > Reset ->done and ->free when releasing the srb. There is a hidden > use-after-free bug in the driver which corrupts the srb memory pool > which originates from the cleanup callbacks. By explicitly resetting > the callbacks to NULL, we workaround the memory corruption. > > An extensive search didn't bring any lights on the real problem. The > initial idea was to set both pointers to NULL and try to catch > invalid > accesses. But instead the memory corruption was gone and the driver > didn't crash. > > Signed-off-by: Daniel Wagner <dwagner@suse.de> > --- > drivers/scsi/qla2xxx/qla_inline.h | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/scsi/qla2xxx/qla_inline.h > b/drivers/scsi/qla2xxx/qla_inline.h > index 861dc522723c..6d41d758fc17 100644 > --- a/drivers/scsi/qla2xxx/qla_inline.h > +++ b/drivers/scsi/qla2xxx/qla_inline.h > @@ -211,6 +211,8 @@ static inline void > qla2xxx_rel_qpair_sp(struct qla_qpair *qpair, srb_t *sp) > { > sp->qpair = NULL; > + sp->done = NULL; > + sp->free = NULL; > mempool_free(sp, qpair->srb_mempool); > QLA_QPAIR_MARK_NOT_BUSY(qpair); > } Both sp->done() and sp->free() are called all over the place without making sure the pointers are non-null. If these functions can be called for freed sp's, wouldn't that mean we'd crash? How about setting them to a dummy function that prints a big fat warning? Martin
> How about setting them to a dummy function that prints a big fat > warning? Good idea. I'll update the patch accordingly. This might even help to find the real cause.
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h index 861dc522723c..6d41d758fc17 100644 --- a/drivers/scsi/qla2xxx/qla_inline.h +++ b/drivers/scsi/qla2xxx/qla_inline.h @@ -211,6 +211,8 @@ static inline void qla2xxx_rel_qpair_sp(struct qla_qpair *qpair, srb_t *sp) { sp->qpair = NULL; + sp->done = NULL; + sp->free = NULL; mempool_free(sp, qpair->srb_mempool); QLA_QPAIR_MARK_NOT_BUSY(qpair); }
Reset ->done and ->free when releasing the srb. There is a hidden use-after-free bug in the driver which corrupts the srb memory pool which originates from the cleanup callbacks. By explicitly resetting the callbacks to NULL, we workaround the memory corruption. An extensive search didn't bring any lights on the real problem. The initial idea was to set both pointers to NULL and try to catch invalid accesses. But instead the memory corruption was gone and the driver didn't crash. Signed-off-by: Daniel Wagner <dwagner@suse.de> --- drivers/scsi/qla2xxx/qla_inline.h | 2 ++ 1 file changed, 2 insertions(+)