> On Mar 22, 2021, at 11:42 PM, Nilesh Javali <njavali@xxxxxxxxxxx> wrote: > > From: Quinn Tran <qutran@xxxxxxxxxxx> > > On bsg command completion, bsg_job_done was called while > qla driver continue to access the bsg_job buffer. The bsg_job_done > can free up resources and reuse by other task, qla continue access > of the same resource can read garbage data. > > localhost kernel: BUG: KASAN: use-after-free in sg_next+0x64/0x80 > localhost kernel: Read of size 8 at addr ffff8883228a3330 by task swapper/26/0 > localhost kernel: > localhost kernel: CPU: 26 PID: 0 Comm: swapper/26 Kdump: > loaded Tainted: G OE --------- - - 4.18.0-193.el8.x86_64+debug #1 > localhost kernel: Hardware name: HP ProLiant DL360 > Gen9/ProLiant DL360 Gen9, BIOS P89 08/12/2016 > localhost kernel: Call Trace: > localhost kernel: <IRQ> > localhost kernel: dump_stack+0x9a/0xf0 > localhost kernel: print_address_description.cold.3+0x9/0x23b > localhost kernel: kasan_report.cold.4+0x65/0x95 > localhost kernel: debug_dma_unmap_sg.part.12+0x10d/0x2d0 > localhost kernel: qla2x00_bsg_sp_free+0xaf6/0x1010 [qla2xxx] > > Signed-off-by: Quinn Tran <qutran@xxxxxxxxxxx> > Signed-off-by: Saurav Kashyap <skashyap@xxxxxxxxxxx> > Signed-off-by: Nilesh Javali <njavali@xxxxxxxxxxx> > --- > drivers/scsi/qla2xxx/qla_bsg.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c > index bee8cf9f8123..d021e51344f5 100644 > --- a/drivers/scsi/qla2xxx/qla_bsg.c > +++ b/drivers/scsi/qla2xxx/qla_bsg.c > @@ -25,10 +25,11 @@ void qla2x00_bsg_job_done(srb_t *sp, int res) > struct bsg_job *bsg_job = sp->u.bsg_job; > struct fc_bsg_reply *bsg_reply = bsg_job->reply; > > + sp->free(sp); > + > bsg_reply->result = res; > bsg_job_done(bsg_job, bsg_reply->result, > bsg_reply->reply_payload_rcv_len); > - sp->free(sp); > } > > void qla2x00_bsg_sp_free(srb_t *sp) > -- > 2.19.0.rc0 > Looks good. Reviewed-by: Himanshu Madhani <himanshu.madhani@xxxxxxxxxx> -- Himanshu Madhani Oracle Linux Engineering
