diff mbox series

scsi: qla2xxx: Fix use after free in debug code

Message ID 20210803155625.GA22735@kili
State New
Headers show
Series scsi: qla2xxx: Fix use after free in debug code | expand

Commit Message

Dan Carpenter Aug. 3, 2021, 3:56 p.m. UTC
The sp->free(sp); call frees "sp" and then the debug code dereferences
it on the next line.  Swap the order.

Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/scsi/qla2xxx/qla_bsg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Ewan Milne Aug. 3, 2021, 4:25 p.m. UTC | #1
Reviewed-by: Ewan D. Milne <emilne@redhat.com>

On Tue, Aug 3, 2021 at 11:57 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> The sp->free(sp); call frees "sp" and then the debug code dereferences
> it on the next line.  Swap the order.
>
> Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/scsi/qla2xxx/qla_bsg.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
> index 0739f8ad525a..4b5d28d89d69 100644
> --- a/drivers/scsi/qla2xxx/qla_bsg.c
> +++ b/drivers/scsi/qla2xxx/qla_bsg.c
> @@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res)
>         struct bsg_job *bsg_job = sp->u.bsg_job;
>         struct fc_bsg_reply *bsg_reply = bsg_job->reply;
>
> -       sp->free(sp);
> -
>         ql_dbg(ql_dbg_user, sp->vha, 0x7009,
>             "%s: sp hdl %x, result=%x bsg ptr %p\n",
>             __func__, sp->handle, res, bsg_job);
>
> +       sp->free(sp);
> +
>         bsg_reply->result = res;
>         bsg_job_done(bsg_job, bsg_reply->result,
>                        bsg_reply->reply_payload_rcv_len);
> --
> 2.20.1
>
Himanshu Madhani Aug. 3, 2021, 5:17 p.m. UTC | #2
> On Aug 3, 2021, at 10:56 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
> 
> The sp->free(sp); call frees "sp" and then the debug code dereferences
> it on the next line.  Swap the order.
> 
> Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/scsi/qla2xxx/qla_bsg.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
> index 0739f8ad525a..4b5d28d89d69 100644
> --- a/drivers/scsi/qla2xxx/qla_bsg.c
> +++ b/drivers/scsi/qla2xxx/qla_bsg.c
> @@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res)
> 	struct bsg_job *bsg_job = sp->u.bsg_job;
> 	struct fc_bsg_reply *bsg_reply = bsg_job->reply;
> 
> -	sp->free(sp);
> -
> 	ql_dbg(ql_dbg_user, sp->vha, 0x7009,
> 	    "%s: sp hdl %x, result=%x bsg ptr %p\n",
> 	    __func__, sp->handle, res, bsg_job);
> 
> +	sp->free(sp);
> +
> 	bsg_reply->result = res;
> 	bsg_job_done(bsg_job, bsg_reply->result,
> 		       bsg_reply->reply_payload_rcv_len);
> -- 
> 2.20.1
> 

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

--
Himanshu Madhani	 Oracle Linux Engineering
Martin K. Petersen Aug. 6, 2021, 3:12 a.m. UTC | #3
Dan,

> The sp->free(sp); call frees "sp" and then the debug code dereferences

> it on the next line.  Swap the order.


Applied to 5.15/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering
Martin K. Petersen Aug. 10, 2021, 5:20 a.m. UTC | #4
On Tue, 3 Aug 2021 18:56:25 +0300, Dan Carpenter wrote:

> The sp->free(sp); call frees "sp" and then the debug code dereferences

> it on the next line.  Swap the order.

> 

> 

> 

> 


Applied to 5.15/scsi-queue, thanks!

[1/1] scsi: qla2xxx: Fix use after free in debug code
      https://git.kernel.org/mkp/scsi/c/e3d2612f583b

-- 
Martin K. Petersen	Oracle Linux Engineering
diff mbox series

Patch

diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 0739f8ad525a..4b5d28d89d69 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -25,12 +25,12 @@  void qla2x00_bsg_job_done(srb_t *sp, int res)
 	struct bsg_job *bsg_job = sp->u.bsg_job;
 	struct fc_bsg_reply *bsg_reply = bsg_job->reply;
 
-	sp->free(sp);
-
 	ql_dbg(ql_dbg_user, sp->vha, 0x7009,
 	    "%s: sp hdl %x, result=%x bsg ptr %p\n",
 	    __func__, sp->handle, res, bsg_job);
 
+	sp->free(sp);
+
 	bsg_reply->result = res;
 	bsg_job_done(bsg_job, bsg_reply->result,
 		       bsg_reply->reply_payload_rcv_len);