lkml.org 
[lkml]   [2019]   [Jun]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 56/61] scsi: scsi_dh_alua: Fix possible null-ptr-deref
    Date
    [ Upstream commit 12e750bc62044de096ab9a95201213fd912b9994 ]

    If alloc_workqueue fails in alua_init, it should return -ENOMEM, otherwise
    it will trigger null-ptr-deref while unloading module which calls
    destroy_workqueue dereference
    wq->lock like this:

    BUG: KASAN: null-ptr-deref in __lock_acquire+0x6b4/0x1ee0
    Read of size 8 at addr 0000000000000080 by task syz-executor.0/7045

    CPU: 0 PID: 7045 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1
    Call Trace:
    dump_stack+0xa9/0x10e
    __kasan_report+0x171/0x18d
    ? __lock_acquire+0x6b4/0x1ee0
    kasan_report+0xe/0x20
    __lock_acquire+0x6b4/0x1ee0
    lock_acquire+0xb4/0x1b0
    __mutex_lock+0xd8/0xb90
    drain_workqueue+0x25/0x290
    destroy_workqueue+0x1f/0x3f0
    __x64_sys_delete_module+0x244/0x330
    do_syscall_64+0x72/0x2a0
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Reported-by: Hulk Robot <hulkci@huawei.com>
    Fixes: 03197b61c5ec ("scsi_dh_alua: Use workqueue for RTPG")
    Signed-off-by: YueHaibing <yuehaibing@huawei.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++----
    1 file changed, 2 insertions(+), 4 deletions(-)

    diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
    index 12dc7100bb4c..d1154baa9436 100644
    --- a/drivers/scsi/device_handler/scsi_dh_alua.c
    +++ b/drivers/scsi/device_handler/scsi_dh_alua.c
    @@ -1173,10 +1173,8 @@ static int __init alua_init(void)
    int r;

    kaluad_wq = alloc_workqueue("kaluad", WQ_MEM_RECLAIM, 0);
    - if (!kaluad_wq) {
    - /* Temporary failure, bypass */
    - return SCSI_DH_DEV_TEMP_BUSY;
    - }
    + if (!kaluad_wq)
    + return -ENOMEM;

    r = scsi_register_device_handler(&alua_dh);
    if (r != 0) {
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-06-20 20:13    [W:3.284 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site