diff options
| author | Daniel Wagner <dwagner@suse.de> | 2020-09-08 10:15:13 +0200 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2020-09-09 22:01:42 -0400 |
| commit | c0014f94218ea3a312f6235febea0d626c5f2154 (patch) | |
| tree | c46afbf94a4c77e1dfbba475cf1b70bb320e905e /drivers/scsi/qla2xxx/qla_inline.h | |
| parent | 988100a7de0f07c27063d1376ebc4eab983e228b (diff) | |
| download | lwn-c0014f94218ea3a312f6235febea0d626c5f2154.tar.gz lwn-c0014f94218ea3a312f6235febea0d626c5f2154.zip | |
scsi: qla2xxx: Warn if done() or free() are called on an already freed srb
Emit a warning when ->done or ->free are called on an already freed
srb. There is a hidden use-after-free bug in the driver which corrupts
the srb memory pool which originates from the cleanup callbacks.
An extensive search didn't bring any lights on the real problem. The
initial fix was to set both pointers to NULL and try to catch invalid
accesses. But instead the memory corruption was gone and the driver
didn't crash. Since not all calling places check for NULL pointer, add
explicitly default handlers. With this we workaround the memory
corruption and add a debug help.
Link: https://lore.kernel.org/r/20200908081516.8561-2-dwagner@suse.de
Reviewed-by: Martin Wilck <mwilck@suse.com>
Reviewed-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/qla2xxx/qla_inline.h')
| -rw-r--r-- | drivers/scsi/qla2xxx/qla_inline.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h index 861dc522723c..2aa6f81f87c4 100644 --- a/drivers/scsi/qla2xxx/qla_inline.h +++ b/drivers/scsi/qla2xxx/qla_inline.h @@ -207,10 +207,15 @@ qla2xxx_get_qpair_sp(scsi_qla_host_t *vha, struct qla_qpair *qpair, return sp; } +void qla2xxx_rel_done_warning(srb_t *sp, int res); +void qla2xxx_rel_free_warning(srb_t *sp); + static inline void qla2xxx_rel_qpair_sp(struct qla_qpair *qpair, srb_t *sp) { sp->qpair = NULL; + sp->done = qla2xxx_rel_done_warning; + sp->free = qla2xxx_rel_free_warning; mempool_free(sp, qpair->srb_mempool); QLA_QPAIR_MARK_NOT_BUSY(qpair); } |