In the post: "[syzbot] KASAN: invalid-free in sg_finish_scsi_blk_rq"
on 20210315 to the linux-scsi list KASAN reported a double free.
Remove the offending scsi_req_free_cmd(scsi_rp) call and note
with a comment where the change in ownership of long SCSI command
(> 16 bytes long) takes place.
Reported-by: syzbot+0a0e8ecea895d38332e6@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Douglas Gilbert <dgilbert@xxxxxxxxxxxx>
---
drivers/scsi/sg.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index b6e06e039d5b..c49f87c97dd4 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -3097,16 +3097,14 @@ sg_start_req(struct sg_request *srp, struct sg_comm_wr_t *cwrp, int dxfer_dir)
set_bit(SG_FFD_HIPRI_SEEN, sfp->ffd_bm);
if (cwrp->cmd_len > BLK_MAX_CDB)
- scsi_rp->cmd = long_cmdp;
+ scsi_rp->cmd = long_cmdp; /* transfer ownership */
if (cwrp->u_cmdp)
res = sg_fetch_cmnd(cwrp->filp, sfp, cwrp->u_cmdp,
cwrp->cmd_len, scsi_rp->cmd);
else
res = -EPROTO;
- if (res) {
- kfree(long_cmdp);
- return res;
- }
+ if (res)
+ goto fini;
scsi_rp->cmd_len = cwrp->cmd_len;
srp->cmd_opcode = scsi_rp->cmd[0];
us_xfer = !(rq_flags & (SG_FLAG_NO_DXFER | SG_FLAG_MMAP_IO));
@@ -3178,7 +3176,6 @@ sg_start_req(struct sg_request *srp, struct sg_comm_wr_t *cwrp, int dxfer_dir)
}
fini:
if (unlikely(res)) { /* failure, free up resources */
- scsi_req_free_cmd(scsi_rp);
if (likely(!test_and_set_bit(SG_FRQ_BLK_PUT_REQ,
srp->frq_bm))) {
srp->rq = NULL;
--
2.25.1
