From patchwork Tue Mar 26 07:38:46 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Saurav Kashyap X-Patchwork-Id: 10870525 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6EFA814DE for ; Tue, 26 Mar 2019 07:39:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5A61E2907B for ; Tue, 26 Mar 2019 07:39:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4EA9D29087; Tue, 26 Mar 2019 07:39:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D8A802907B for ; Tue, 26 Mar 2019 07:39:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731128AbfCZHj5 (ORCPT ); Tue, 26 Mar 2019 03:39:57 -0400 Received: from mail-eopbgr800082.outbound.protection.outlook.com ([40.107.80.82]:27204 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1730935AbfCZHj5 (ORCPT ); Tue, 26 Mar 2019 03:39:57 -0400 Received: from DM5PR07CA0087.namprd07.prod.outlook.com (2603:10b6:4:ae::16) by SN2PR07MB2541.namprd07.prod.outlook.com (2603:10b6:804:7::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.16; Tue, 26 Mar 2019 07:39:55 +0000 Received: from DM3NAM05FT017.eop-nam05.prod.protection.outlook.com (2a01:111:f400:7e51::209) by DM5PR07CA0087.outlook.office365.com (2603:10b6:4:ae::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.15 via Frontend Transport; Tue, 26 Mar 2019 07:39:55 +0000 Authentication-Results: spf=fail (sender IP is 199.233.58.38) smtp.mailfrom=marvell.com; vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=fail action=none header.from=marvell.com; Received-SPF: Fail (protection.outlook.com: domain of marvell.com does not designate 199.233.58.38 as permitted sender) receiver=protection.outlook.com; client-ip=199.233.58.38; helo=CAEXCH02.caveonetworks.com; Received: from CAEXCH02.caveonetworks.com (199.233.58.38) by DM3NAM05FT017.mail.protection.outlook.com (10.152.98.126) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) id 15.20.1750.4 via Frontend Transport; Tue, 26 Mar 2019 07:39:54 +0000 Received: from dut1171.mv.qlogic.com (10.112.88.18) by CAEXCH02.caveonetworks.com (10.67.98.110) with Microsoft SMTP Server (TLS) id 14.2.347.0; Tue, 26 Mar 2019 00:39:40 -0700 Received: from dut1171.mv.qlogic.com (localhost [127.0.0.1]) by dut1171.mv.qlogic.com (8.14.7/8.14.7) with ESMTP id x2Q7de8k026883; Tue, 26 Mar 2019 00:39:40 -0700 Received: (from root@localhost) by dut1171.mv.qlogic.com (8.14.7/8.14.7/Submit) id x2Q7dehL026882; Tue, 26 Mar 2019 00:39:40 -0700 From: Saurav Kashyap To: CC: , Subject: [PATCH v2 14/26] qedf: Add additional checks for io_req->sc_cmd validity. Date: Tue, 26 Mar 2019 00:38:46 -0700 Message-ID: <20190326073858.26792-15-skashyap@marvell.com> X-Mailer: git-send-email 2.12.0 In-Reply-To: <20190326073858.26792-1-skashyap@marvell.com> References: <20190326073858.26792-1-skashyap@marvell.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-Matching-Connectors: 131980595950963872;(abac79dc-c90b-41ba-8033-08d666125e47);(abac79dc-c90b-41ba-8033-08d666125e47) X-Forefront-Antispam-Report: CIP:199.233.58.38;IPV:CAL;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10009020)(136003)(396003)(346002)(39860400002)(376002)(2980300002)(1109001)(1110001)(339900001)(189003)(199004)(2351001)(76176011)(36756003)(6862004)(53936002)(356004)(4326008)(11346002)(476003)(2616005)(486006)(50466002)(51416003)(446003)(126002)(48376002)(336012)(5660300002)(106466001)(86362001)(2906002)(105606002)(81166006)(47776003)(1076003)(26826003)(81156014)(97736004)(54906003)(305945005)(16586007)(80596001)(85426001)(87636003)(36906005)(26005)(42186006)(316002)(8936002)(50226002)(68736007)(498600001)(8676002)(69596002);DIR:OUT;SFP:1101;SCL:1;SRVR:SN2PR07MB2541;H:CAEXCH02.caveonetworks.com;FPR:;SPF:Fail;LANG:en;PTR:InfoDomainNonexistent;MX:1;A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 122e1806-71b3-45c8-7e76-08d6b1be3d5d X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(5600127)(711020)(4605104)(2017052603328);SRVR:SN2PR07MB2541; X-MS-TrafficTypeDiagnostic: SN2PR07MB2541: X-Microsoft-Antispam-PRVS: X-Forefront-PRVS: 09888BC01D X-Microsoft-Antispam-Message-Info: xLgvFw9Jw0tSVp9rC8Ahl5CQgv2cboCLAyFHhmcX8imDx54orTPNrUgHhSeHvRl5qSGxO6RLb3/8Mngx/fFzgv72btQ2QSXfSem362jy92JymUZMsyRLxn8gTzObwe9O6E1xGFes2XMiPiiZf6AYNiJPYPR6aAqj06kJBaMU0b7jbHLLAzgknt82PBxYg6yUvDkdTTkpUiZPCpl2bpyuOqQvlvyBJKuX8vdEnGOBp+QlLQDod5Lpy+zJYchJu4OQrdF82aHW0YooMOmZZzunjc5fFxO0Ajv8BQBXWTXdT4z47hIslAlmsjq21mhCbST3eJH3igYgY6oaTOxAFrs+6344znbe0v6Vix6weKqviBsfbofPFo6VisfQgap7yqASF3SnMH+77dssNECmsSNNhLcpa3kUHk9LTqz/IwXBrYE= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Mar 2019 07:39:54.7557 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 122e1806-71b3-45c8-7e76-08d6b1be3d5d X-MS-Exchange-CrossTenant-Id: 5afe0b00-7697-4969-b663-5eab37d5f47e X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5afe0b00-7697-4969-b663-5eab37d5f47e;Ip=[199.233.58.38];Helo=[CAEXCH02.caveonetworks.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN2PR07MB2541 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Chad Dupuis - Check the validity of various pointers before processing. Signed-off-by: Chad Dupuis Signed-off-by: Saurav Kashyap --- drivers/scsi/qedf/qedf_io.c | 39 +++++++++++++++++++++++++++++++++++++-- 1 file changed, 37 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c index ab67056..8d09cf3 100644 --- a/drivers/scsi/qedf/qedf_io.c +++ b/drivers/scsi/qedf/qedf_io.c @@ -1324,7 +1324,7 @@ void qedf_scsi_done(struct qedf_ctx *qedf, struct qedf_ioreq *io_req, if (!virt_addr_valid(sc_cmd)) { QEDF_ERR(&qedf->dbg_ctx, "sc_cmd=%p is not valid.", sc_cmd); - return; + goto bad_scsi_ptr; } if (!sc_cmd->SCp.ptr) { @@ -1336,7 +1336,34 @@ void qedf_scsi_done(struct qedf_ctx *qedf, struct qedf_ioreq *io_req, if (!sc_cmd->device) { QEDF_ERR(&qedf->dbg_ctx, "Device for sc_cmd %p is NULL.\n", sc_cmd); - return; + goto bad_scsi_ptr; + } + + if (!virt_addr_valid(sc_cmd->device)) { + QEDF_ERR(&qedf->dbg_ctx, + "Device pointer for sc_cmd %p is bad.\n", sc_cmd); + goto bad_scsi_ptr; + } + + if (!sc_cmd->sense_buffer) { + QEDF_ERR(&qedf->dbg_ctx, + "sc_cmd->sense_buffer for sc_cmd %p is NULL.\n", + sc_cmd); + goto bad_scsi_ptr; + } + + if (!virt_addr_valid(sc_cmd->sense_buffer)) { + QEDF_ERR(&qedf->dbg_ctx, + "sc_cmd->sense_buffer for sc_cmd %p is bad.\n", + sc_cmd); + goto bad_scsi_ptr; + } + + if (!sc_cmd->scsi_done) { + QEDF_ERR(&qedf->dbg_ctx, + "sc_cmd->scsi_done for sc_cmd %p is NULL.\n", + sc_cmd); + goto bad_scsi_ptr; } qedf_unmap_sg_list(qedf, io_req); @@ -1365,6 +1392,14 @@ void qedf_scsi_done(struct qedf_ctx *qedf, struct qedf_ioreq *io_req, sc_cmd->SCp.ptr = NULL; sc_cmd->scsi_done(sc_cmd); kref_put(&io_req->refcount, qedf_release_cmd); + +bad_scsi_ptr: + /* + * Clear the io_req->sc_cmd backpointer so we don't try to process + * this again + */ + io_req->sc_cmd = NULL; + kref_put(&io_req->refcount, qedf_release_cmd); /* ID: 001 */ } /*