On 2022/4/19 22:56, Hannes Reinecke wrote: > On 4/19/22 16:28, Wenchao Hao wrote: >> Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd >> if host reset failed. If host reset failed and eh_cmd_q of shost is not empty, >> these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs() >> and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related >> request would be freed. >> > Yes. > >> While since host reset failed, we can not guarantee the LLDDs has cleared all >> references to these commands in eh_cmd_q. Is there any possibility that the >> LLDDs reference to these commands? If this happened, then a using after free >> issue would occur. >> > If host reset has failed there are _no_ assumptions we can make about commands, and not even about the PCI device itself. > So in effect, once host_reset failed the system is hosed. > > We _might_ be able to resurrect the system by doing PCI EEH, but not many systems nor drivers implement that. > > Cheers, > > Hannes > > . Thanks a lot for your reply. I am writing single LUN reset EH flow which discussed in previous mail and testing it, if the test result is good I would post it. By the way, you said you would make EH rework, are you doing it? Could you tell us your plan if it's not secret.
