Patch "scsi: qla2xxx: Warn if done() or free() are called on an already freed srb" has been added to the 5.8-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    scsi: qla2xxx: Warn if done() or free() are called on an already freed srb

to the 5.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     scsi-qla2xxx-warn-if-done-or-free-are-called-on-an-a.patch
and it can be found in the queue-5.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 22f4b0e90716e6c83f3d14e43fd68df031dc2ce1
Author: Daniel Wagner <dwagner@xxxxxxx>
Date:   Tue Sep 8 10:15:13 2020 +0200

    scsi: qla2xxx: Warn if done() or free() are called on an already freed srb
    
    [ Upstream commit c0014f94218ea3a312f6235febea0d626c5f2154 ]
    
    Emit a warning when ->done or ->free are called on an already freed
    srb. There is a hidden use-after-free bug in the driver which corrupts
    the srb memory pool which originates from the cleanup callbacks.
    
    An extensive search didn't bring any lights on the real problem. The
    initial fix was to set both pointers to NULL and try to catch invalid
    accesses. But instead the memory corruption was gone and the driver
    didn't crash. Since not all calling places check for NULL pointer, add
    explicitly default handlers. With this we workaround the memory
    corruption and add a debug help.
    
    Link: https://lore.kernel.org/r/20200908081516.8561-2-dwagner@xxxxxxx
    Reviewed-by: Martin Wilck <mwilck@xxxxxxxx>
    Reviewed-by: Arun Easi <aeasi@xxxxxxxxxxx>
    Signed-off-by: Daniel Wagner <dwagner@xxxxxxx>
    Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 2861c636dd651..f17ab22ad0e4a 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -63,6 +63,16 @@ void qla2x00_sp_free(srb_t *sp)
 	qla2x00_rel_sp(sp);
 }
 
+void qla2xxx_rel_done_warning(srb_t *sp, int res)
+{
+	WARN_ONCE(1, "Calling done() of an already freed srb %p object\n", sp);
+}
+
+void qla2xxx_rel_free_warning(srb_t *sp)
+{
+	WARN_ONCE(1, "Calling free() of an already freed srb %p object\n", sp);
+}
+
 /* Asynchronous Login/Logout Routines -------------------------------------- */
 
 unsigned long
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 1fb6ccac07ccd..26d9c78d4c52c 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -207,10 +207,15 @@ qla2xxx_get_qpair_sp(scsi_qla_host_t *vha, struct qla_qpair *qpair,
 	return sp;
 }
 
+void qla2xxx_rel_done_warning(srb_t *sp, int res);
+void qla2xxx_rel_free_warning(srb_t *sp);
+
 static inline void
 qla2xxx_rel_qpair_sp(struct qla_qpair *qpair, srb_t *sp)
 {
 	sp->qpair = NULL;
+	sp->done = qla2xxx_rel_done_warning;
+	sp->free = qla2xxx_rel_free_warning;
 	mempool_free(sp, qpair->srb_mempool);
 	QLA_QPAIR_MARK_NOT_BUSY(qpair);
 }