lkml.org 
[lkml]   [2020]   [Dec]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.9 06/48] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition
    Date
    From: yuuzheng <yuuzheng@google.com>

    [ Upstream commit 1f889b58716a5f5e3e4fe0e6742c1a4472f29ac1 ]

    A use-after-free or null-pointer error occurs when the 251-byte response
    data is copied from IOMB buffer to response message buffer in function
    pm8001_mpi_get_nvmd_resp().

    After sending the command get_nvmd_data(), the caller begins to sleep by
    calling wait_for_complete() and waits for the wake-up from calling
    complete() in pm8001_mpi_get_nvmd_resp(). Due to unexpected events (e.g.,
    interrupt), if response buffer gets freed before memcpy(), a use-after-free
    error will occur. To fix this, the complete() should be called after
    memcpy().

    Link: https://lore.kernel.org/r/20201102165528.26510-5-Viswas.G@microchip.com.com
    Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
    Signed-off-by: yuuzheng <yuuzheng@google.com>
    Signed-off-by: Viswas G <Viswas.G@microchip.com>
    Signed-off-by: Ruksar Devadi <Ruksar.devadi@microchip.com>
    Signed-off-by: Radha Ramachandran <radha@google.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/pm8001/pm8001_hwi.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
    index f374abfb7f1f8..44a4630fdb2f8 100644
    --- a/drivers/scsi/pm8001/pm8001_hwi.c
    +++ b/drivers/scsi/pm8001/pm8001_hwi.c
    @@ -3196,10 +3196,15 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
    pm8001_ha->memoryMap.region[NVMD].virt_ptr,
    fw_control_context->len);
    kfree(ccb->fw_control_context);
    + /* To avoid race condition, complete should be
    + * called after the message is copied to
    + * fw_control_context->usrAddr
    + */
    + complete(pm8001_ha->nvmd_completion);
    + PM8001_MSG_DBG(pm8001_ha, pm8001_printk("Set nvm data complete!\n"));
    ccb->task = NULL;
    ccb->ccb_tag = 0xFFFFFFFF;
    pm8001_tag_free(pm8001_ha, tag);
    - complete(pm8001_ha->nvmd_completion);
    }

    int pm8001_mpi_local_phy_ctl(struct pm8001_hba_info *pm8001_ha, void *piomb)
    --
    2.27.0
    \
     
     \ /
      Last update: 2020-12-23 03:37    [W:4.106 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site