Passing an invalid value to max_queue may cause memory corruption
or kernel freeze.
E.g.
[ 1841.074356] INFO: task rmmod:18774 blocked for more than 120 seconds.
[ 1841.074400] Not tainted 4.18.0-151.el8.ppc64le #1
[ 1841.074435] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1841.074486] rmmod D 0 18774 17507 0x00040080
[ 1841.074549] Call Trace:
[ 1841.074569] [c0000001eae2b380] [c00000018ae47600] 0xc00000018ae47600 (unreliable)
[ 1841.074622] [c0000001eae2b550] [c00000000001f9a0] __switch_to+0x2e0/0x4e0
[ 1841.074666] [c0000001eae2b5b0] [c000000000d716b4] __schedule+0x2c4/0x8e0
[ 1841.074712] [c0000001eae2b680] [c000000000d71d28] schedule+0x58/0x120
[ 1841.074755] [c0000001eae2b6b0] [c000000000188a44] async_synchronize_cookie_domain+0x174/0x360
[ 1841.074848] [c0000001eae2b780] [d000000002e228b0] sd_remove+0x78/0x120 [sd_mod]
[ 1841.074908] [c0000001eae2b7c0] [c0000000008af084] device_release_driver_internal+0x2d4/0x3f0
[ 1841.074971] [c0000001eae2b810] [c0000000008ac368] bus_remove_device+0x128/0x270
[ 1841.075025] [c0000001eae2b890] [c0000000008a6828] device_del+0x298/0x590
[ 1841.075074] [c0000001eae2b940] [c00000000091dfe0] __scsi_remove_device+0x190/0x1f0
[ 1841.075127] [c0000001eae2b980] [c000000000919bb4] scsi_forget_host+0xa4/0xb0
[ 1841.075180] [c0000001eae2b9b0] [c000000000907a8c] scsi_remove_host+0xac/0x3a0
[ 1841.075241] [c0000001eae2ba40] [d000000002624d9c] sdebug_driver_remove+0x44/0x150 [scsi_debug]
[ 1841.075302] [c0000001eae2bad0] [c0000000008af084] device_release_driver_internal+0x2d4/0x3f0
[ 1841.075364] [c0000001eae2bb20] [c0000000008ac368] bus_remove_device+0x128/0x270
[ 1841.075417] [c0000001eae2bba0] [c0000000008a6828] device_del+0x298/0x590
[ 1841.075461] [c0000001eae2bc50] [c0000000008a6b50] device_unregister+0x30/0xa0
[ 1841.075515] [c0000001eae2bcc0] [d000000002623a8c] sdebug_remove_adapter+0xe4/0x130 [scsi_debug]
[ 1841.075599] [c0000001eae2bd00] [d00000000262eeb8] scsi_debug_exit+0x50/0x1348 [scsi_debug]
[ 1841.075652] [c0000001eae2bd60] [c0000000002453f0] sys_delete_module+0x210/0x380
[ 1841.075706] [c0000001eae2be30] [c00000000000b388] system_call+0x5c/0x70
Signed-off-by: Maurizio Lombardi <mlombard@xxxxxxxxxx>
---
drivers/scsi/scsi_debug.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 44cb054d5e66..c2779012d968 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -5268,6 +5268,11 @@ static int __init scsi_debug_init(void)
return -EINVAL;
}
+ if (sdebug_max_queue <= 0 || sdebug_max_queue > SDEBUG_CANQUEUE) {
+ pr_err("max_queue must be > 0 and <= %d\n", SDEBUG_CANQUEUE);
+ return -EINVAL;
+ }
+
if (sdebug_guard > 1) {
pr_err("guard must be 0 or 1\n");
return -EINVAL;
--
Maurizio Lombardi
