AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity
c85c6fadbe
kernel_optimize_test/drivers/scsi
History
Dmitry Bogdanov a6cb5e09e1 scsi: qla2xxx: Fix unmap of already freed sgl 
[ Upstream commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 ]

The sgl is freed in the target stack in target_release_cmd_kref() before
calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that
causes a panic if sgl is not yet DMA unmapped:

NIP dma_direct_unmap_sg+0xdc/0x180
LR  dma_direct_unmap_sg+0xc8/0x180
Call Trace:
 ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable)
 dma_unmap_sg_attrs+0x54/0xf0
 qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx]
 qlt_free_cmd+0x124/0x1d0 [qla2xxx]
 tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx]
 target_put_sess_cmd+0x198/0x370 [target_core_mod]
 transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod]
 tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx]

The sgl may be left unmapped in error cases of response sending.  For
instance, qlt_rdy_to_xfer() maps sgl and exits when session is being
deleted keeping the sgl mapped.

This patch removes use-after-free of the sgl and ensures that the sgl is
unmapped for any command that was not sent to firmware.

Link: https://lore.kernel.org/r/20211018122650.11846-1-d.bogdanov@yadro.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 14:03:41 +01:00
..
aacraid scsi: aacraid: Improve compat_ioctl handlers 2020-12-30 11:53:02 +01:00
aic7xxx scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 2021-07-25 14:36:16 +02:00
aic94xx scsi: libsas: Add LUN number check in .slave_alloc callback 2021-07-25 14:36:16 +02:00
arcmsr scsi: arcmsr: Fix doorbell status being updated late on ARC-1886 2021-07-20 16:05:39 +02:00
arm SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
be2iscsi scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() 2021-07-20 16:05:58 +02:00
bfa SCSI misc on 20201023 2020-10-23 16:19:02 -07:00
bnx2fc scsi: bnx2fc: Return failure if io_req is already in ABTS processing 2021-06-16 12:01:36 +02:00
bnx2i scsi: iscsi: Fix shost->max_id use 2021-07-20 16:05:41 +02:00
csiostor scsi: csiostor: Add module softdep on cxgb4 2021-10-06 15:55:56 +02:00
cxgbi scsi: iscsi: Fix shost->max_id use 2021-07-20 16:05:41 +02:00
cxlflash powerpc updates for 5.10 2020-10-16 12:21:15 -07:00
device_handler scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() 2021-08-26 08:35:37 -04:00
dpt
esas2r SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
fcoe SCSI misc on 20201023 2020-10-23 16:19:02 -07:00
fnic scsi: fnic: Fix memleak in vnic_dev_init_devcmd2 2021-02-07 15:37:14 +01:00
hisi_sas scsi: libsas: Add LUN number check in .slave_alloc callback 2021-07-25 14:36:16 +02:00
ibmvscsi scsi: ibmvfc: Fix invalid state machine BUG_ON() 2021-05-14 09:50:27 +02:00
ibmvscsi_tgt treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
isci scsi: libsas: Add LUN number check in .slave_alloc callback 2021-07-25 14:36:16 +02:00
libfc scsi: libfc: Fix array index out of bound exception 2021-07-25 14:36:16 +02:00
libsas scsi: libsas: Add LUN number check in .slave_alloc callback 2021-07-25 14:36:16 +02:00
lpfc scsi: lpfc: Use correct scnprintf() limit 2021-09-30 10:11:04 +02:00
megaraid scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() 2021-08-26 08:35:36 -04:00
mpt3sas scsi: mpt3sas: Fix deadlock while cancelling the running firmware event 2021-07-20 16:05:40 +02:00
mvsas scsi: libsas: Add LUN number check in .slave_alloc callback 2021-07-25 14:36:16 +02:00
pcmcia scsi: fdomain: Fix error return code in fdomain_probe() 2021-09-18 13:40:14 +02:00
pm8001 scsi: pm80xx: Fix TMF task completion race condition 2021-08-26 08:35:36 -04:00
qedf scsi: qedf: Fix error codes in qedf_alloc_global_queues() 2021-09-18 13:40:14 +02:00
qedi scsi: qedi: Fix error codes in qedi_alloc_global_queues() 2021-09-18 13:40:14 +02:00
qla2xxx scsi: qla2xxx: Fix unmap of already freed sgl 2021-11-18 14:03:41 +01:00
qla4xxx SCSI misc on 20201023 2020-10-23 16:19:02 -07:00
smartpqi scsi: smartpqi: Fix an error code in pqi_get_raid_map() 2021-09-18 13:40:14 +02:00
snic scsi: snic: Simplify the return expression of svnic_cq_alloc() 2020-10-07 23:50:03 -04:00
sym53c8xx_2 SCSI misc on 20201023 2020-10-23 16:19:02 -07:00
ufs scsi: ufs: ufs-exynos: Correct timeout value setting registers 2021-11-02 19:48:25 +01:00
.gitignore
3w-9xxx.c
3w-9xxx.h
3w-sas.c
3w-sas.h
3w-xxxx.c
3w-xxxx.h
53c700_d.h_shipped
53c700.c SCSI misc on 20201023 2020-10-23 16:19:02 -07:00
53c700.h 53c700: improve non-coherent DMA handling 2020-09-25 06:20:43 +02:00
53c700.scr
a100u2w.c
a100u2w.h
a2091.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
a2091.h
a3000.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
a3000.h
a4000t.c
advansys.c
aha152x.c scsi: aha152x: Remove unused variable 'ret' 2020-07-08 01:12:53 -04:00
aha152x.h
aha1542.c
aha1542.h
aha1740.c
aha1740.h
am53c974.c
atari_scsi.c
atp870u.c
atp870u.h
BusLogic.c scsi: BusLogic: Fix missing pr_cont() use 2021-09-18 13:40:35 +02:00
BusLogic.h scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic 2021-06-03 09:00:43 +02:00
bvme6000_scsi.c
ch.c
constants.c
dc395x.c scsi: dc395x: Use module_pci_driver() to simplify the code 2020-10-07 21:48:28 -04:00
dc395x.h
dmx3191d.c
dpt_i2o.c scsi: dpt_i2o: Remove set but not used 'pHba' 2020-09-01 22:15:47 -04:00
dpti.h
esp_scsi.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
esp_scsi.h
fdomain_isa.c scsi: fdomain_isa: Merge branches in fdomain_isa_match() 2020-09-02 22:49:07 -04:00
fdomain_pci.c
fdomain.c
fdomain.h scsi: fdomain: Mark 'fdomain_pm_ops' as __maybe_unused 2020-07-08 01:12:44 -04:00
FlashPoint.c scsi: FlashPoint: Rename si_flags field 2021-07-14 16:56:40 +02:00
g_NCR5380.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
gdth_ioctl.h
gdth_proc.c
gdth_proc.h
gdth.c scsi: gdth: Make option_setup() static 2020-10-07 21:48:28 -04:00
gdth.h
gvp11.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
gvp11.h
hosts.c scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() 2021-10-27 09:56:56 +02:00
hpsa_cmd.h scsi: hpsa: Update copyright 2020-09-02 22:49:06 -04:00
hpsa.c scsi: hpsa: Fix memory leak in hpsa_init_one() 2020-10-29 21:55:21 -04:00
hpsa.h scsi: hpsa: Update copyright 2020-09-02 22:49:06 -04:00
hptiop.c
hptiop.h
imm.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
imm.h
initio.c scsi: initio: Use module_pci_driver() to simplify the code 2020-10-07 21:48:28 -04:00
initio.h
ipr.c SCSI misc on 20200806 2020-08-06 16:50:07 -07:00
ipr.h scsi: ipr: Fix struct packed-not-aligned issues 2020-07-15 17:26:58 -04:00
ips.c scsi: ips: Convert strnlen() to memcpy() since result should not be NUL terminated 2020-07-24 22:32:00 -04:00
ips.h
iscsi_boot_sysfs.c scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj 2020-06-02 21:23:47 -04:00
iscsi_tcp.c block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
iscsi_tcp.h
jazz_esp.c scsi: jazz_esp: Add IRQ check 2021-05-14 09:50:27 +02:00
Kconfig scsi: lpfc: Add dependency on CPU_FREQ 2020-07-24 22:09:55 -04:00
lasi700.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
libiscsi_tcp.c scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() 2020-10-02 15:27:08 -07:00
libiscsi.c scsi: iscsi: Fix conn use after free during resets 2021-07-20 16:05:41 +02:00
mac_esp.c scsi: mac_esp: Use module_platform_driver to simplify the code 2020-10-02 21:52:53 -04:00
mac_scsi.c
mac53c94.c mm: reorder includes after introduction of linux/pgtable.h 2020-06-09 09:39:13 -07:00
mac53c94.h
Makefile
megaraid.c SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
megaraid.h
mesh.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
mesh.h
mvme16x_scsi.c
mvme147.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
mvme147.h
mvumi.c scsi: mvumi: Fix error return in mvumi_io_attach() 2020-10-02 21:42:22 -04:00
mvumi.h
myrb.c SCSI misc on 20201023 2020-10-23 16:19:02 -07:00
myrb.h
myrs.c scsi: myrs: Fix a double free in myrs_cleanup() 2021-03-25 09:04:09 +01:00
myrs.h
ncr53c8xx.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
ncr53c8xx.h
NCR5380.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
NCR5380.h
nsp32_debug.c
nsp32_io.h
nsp32.c scsi: nsp32: Remove unneeded semicolon 2020-09-15 17:34:18 -04:00
nsp32.h
pmcraid.c scsi: pmcraid: Remove set but not used 'res' 2020-09-09 22:40:41 -04:00
pmcraid.h
ppa.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
ppa.h
ps3rom.c
qla1280.c scsi: qla1280: Remove set but not used variable in qla1280_status_entry() 2020-09-09 22:37:48 -04:00
qla1280.h
qlogicfas.c
qlogicfas408.c
qlogicfas408.h
qlogicpti.c SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
qlogicpti.h
raid_class.c
script_asm.pl
scsi_common.c
scsi_debug.c scsi: scsi_debug: Fix a memory leak 2021-02-17 11:02:27 +01:00
scsi_debugfs.c
scsi_debugfs.h
scsi_devinfo.c scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V 2021-06-18 10:00:05 +02:00
scsi_dh.c scsi: dh: Add Fujitsu device to devinfo and dh lists 2020-07-08 01:16:23 -04:00
scsi_error.c SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
scsi_ioctl.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
scsi_lib_dma.c
scsi_lib.c scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd() 2021-11-18 14:03:37 +01:00
scsi_logging.c scsi: core: Delete unnecessary buffer allocation for every loop iteration 2020-07-24 22:09:57 -04:00
scsi_logging.h
scsi_netlink.c
scsi_pm.c scsi: block: pm: Simplify resume handling 2020-07-24 22:09:55 -04:00
scsi_priv.h scsi: core: Add limitless cmd retry support 2020-10-02 18:53:06 -04:00
scsi_proc.c
scsi_sas_internal.h
scsi_scan.c scsi: core: Avoid printing an error if target_alloc() returns -ENXIO 2021-08-26 08:35:37 -04:00
scsi_sysctl.c
scsi_sysfs.c scsi: core: Put LLD module refcnt after SCSI device is released 2021-11-06 14:10:08 +01:00
scsi_trace.c
scsi_transport_api.h
scsi_transport_fc.c scsi: fc: Add 256GBit speed setting to SCSI FC transport 2020-09-02 22:49:07 -04:00
scsi_transport_iscsi.c scsi: iscsi: Fix set_param() handling 2021-10-27 09:56:55 +02:00
scsi_transport_sas.c scsi: core: Fixup calling convention for scsi_mode_sense() 2021-07-20 16:05:40 +02:00
scsi_transport_spi.c scsi: scsi_transport_spi: Set RQF_PM for domain validation commands 2021-01-12 20:18:15 +01:00
scsi_transport_srp.c scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state 2021-04-21 13:00:52 +02:00
scsi.c scsi: core: Put LLD module refcnt after SCSI device is released 2021-11-06 14:10:08 +01:00
scsi.h
scsicam.c
sd_dif.c
sd_zbc.c scsi: sd_zbc: Ensure buffer size is aligned to SECTOR_SIZE 2021-09-30 10:11:01 +02:00
sd.c scsi: sd: Free scsi_disk device via put_device() 2021-10-09 14:40:56 +02:00
sd.h SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
sense_codes.h scsi: core: Update additional sense codes list 2020-09-15 20:28:06 -04:00
ses.c scsi: ses: Fix unsigned comparison with less than zero 2021-10-17 10:43:33 +02:00
sg.c iov_iter: transparently handle compat iovecs in import_iovec 2020-10-03 00:02:13 -04:00
sgiwd93.c sgiwd93: convert to dma_alloc_noncoherent 2020-09-25 06:20:44 +02:00
sim710.c
sni_53c710.c scsi: sni_53c710: Add IRQ check 2021-05-14 09:50:27 +02:00
sr_ioctl.c
sr_vendor.c
sr.c scsi: sr: Return correct event when media event code is 3 2021-08-12 13:22:04 +02:00
sr.h
st_options.h
st.c scsi: st: Fix a use after free in st_open() 2021-04-07 15:00:05 +02:00
st.h
stex.c
storvsc_drv.c scsi: storvsc: Correctly handle multiple flags in srb_status 2021-07-20 16:05:43 +02:00
sun_esp.c scsi: sun_esp: Use module_platform_driver to simplify the code 2020-10-02 21:52:55 -04:00
sun3_scsi_vme.c
sun3_scsi.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
sun3x_esp.c scsi: sun3x_esp: Add IRQ check 2021-05-14 09:50:27 +02:00
virtio_scsi.c scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" 2021-10-17 10:43:33 +02:00
vmw_pvscsi.c scsi: vmw_pvscsi: Set correct residual data length 2021-06-16 12:01:37 +02:00
vmw_pvscsi.h
wd33c93.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
wd33c93.h
wd719x.c
wd719x.h
xen-scsifront.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
zalon.c
zorro_esp.c mm: reorder includes after introduction of linux/pgtable.h 2020-06-09 09:39:13 -07:00
zorro7xx.c