| Message ID | 20210803155625.GA22735@kili |
|---|---|
| State | New |
| Headers | show |
| Series | scsi: qla2xxx: Fix use after free in debug code | expand |
Reviewed-by: Ewan D. Milne <emilne@redhat.com> On Tue, Aug 3, 2021 at 11:57 AM Dan Carpenter <dan.carpenter@oracle.com> wrote: > > The sp->free(sp); call frees "sp" and then the debug code dereferences > it on the next line. Swap the order. > > Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/scsi/qla2xxx/qla_bsg.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c > index 0739f8ad525a..4b5d28d89d69 100644 > --- a/drivers/scsi/qla2xxx/qla_bsg.c > +++ b/drivers/scsi/qla2xxx/qla_bsg.c > @@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res) > struct bsg_job *bsg_job = sp->u.bsg_job; > struct fc_bsg_reply *bsg_reply = bsg_job->reply; > > - sp->free(sp); > - > ql_dbg(ql_dbg_user, sp->vha, 0x7009, > "%s: sp hdl %x, result=%x bsg ptr %p\n", > __func__, sp->handle, res, bsg_job); > > + sp->free(sp); > + > bsg_reply->result = res; > bsg_job_done(bsg_job, bsg_reply->result, > bsg_reply->reply_payload_rcv_len); > -- > 2.20.1 >
> On Aug 3, 2021, at 10:56 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote: > > The sp->free(sp); call frees "sp" and then the debug code dereferences > it on the next line. Swap the order. > > Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/scsi/qla2xxx/qla_bsg.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c > index 0739f8ad525a..4b5d28d89d69 100644 > --- a/drivers/scsi/qla2xxx/qla_bsg.c > +++ b/drivers/scsi/qla2xxx/qla_bsg.c > @@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res) > struct bsg_job *bsg_job = sp->u.bsg_job; > struct fc_bsg_reply *bsg_reply = bsg_job->reply; > > - sp->free(sp); > - > ql_dbg(ql_dbg_user, sp->vha, 0x7009, > "%s: sp hdl %x, result=%x bsg ptr %p\n", > __func__, sp->handle, res, bsg_job); > > + sp->free(sp); > + > bsg_reply->result = res; > bsg_job_done(bsg_job, bsg_reply->result, > bsg_reply->reply_payload_rcv_len); > -- > 2.20.1 > Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> -- Himanshu Madhani Oracle Linux Engineering
Dan, > The sp->free(sp); call frees "sp" and then the debug code dereferences > it on the next line. Swap the order. Applied to 5.15/scsi-staging, thanks! -- Martin K. Petersen Oracle Linux Engineering
On Tue, 3 Aug 2021 18:56:25 +0300, Dan Carpenter wrote: > The sp->free(sp); call frees "sp" and then the debug code dereferences > it on the next line. Swap the order. > > > > Applied to 5.15/scsi-queue, thanks! [1/1] scsi: qla2xxx: Fix use after free in debug code https://git.kernel.org/mkp/scsi/c/e3d2612f583b -- Martin K. Petersen Oracle Linux Engineering
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c index 0739f8ad525a..4b5d28d89d69 100644 --- a/drivers/scsi/qla2xxx/qla_bsg.c +++ b/drivers/scsi/qla2xxx/qla_bsg.c @@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res) struct bsg_job *bsg_job = sp->u.bsg_job; struct fc_bsg_reply *bsg_reply = bsg_job->reply; - sp->free(sp); - ql_dbg(ql_dbg_user, sp->vha, 0x7009, "%s: sp hdl %x, result=%x bsg ptr %p\n", __func__, sp->handle, res, bsg_job); + sp->free(sp); + bsg_reply->result = res; bsg_job_done(bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);
The sp->free(sp); call frees "sp" and then the debug code dereferences it on the next line. Swap the order. Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/scsi/qla2xxx/qla_bsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)