]> git.baikalelectronics.ru Git - kernel.git/commit
scsi: qla2xxx: Warn if done() or free() are called on an already freed srb
authorDaniel Wagner <dwagner@suse.de>
Tue, 8 Sep 2020 08:15:13 +0000 (10:15 +0200)
committerMartin K. Petersen <martin.petersen@oracle.com>
Thu, 10 Sep 2020 02:01:42 +0000 (22:01 -0400)
commit6c444a6df4d0b8ab61ec6727de2f5b7aac8ac43b
treec46afbf94a4c77e1dfbba475cf1b70bb320e905e
parent8da0c63b4756b63bbce8ea4b7161b09faaba37bd
scsi: qla2xxx: Warn if done() or free() are called on an already freed srb

Emit a warning when ->done or ->free are called on an already freed
srb. There is a hidden use-after-free bug in the driver which corrupts
the srb memory pool which originates from the cleanup callbacks.

An extensive search didn't bring any lights on the real problem. The
initial fix was to set both pointers to NULL and try to catch invalid
accesses. But instead the memory corruption was gone and the driver
didn't crash. Since not all calling places check for NULL pointer, add
explicitly default handlers. With this we workaround the memory
corruption and add a debug help.

Link: https://lore.kernel.org/r/20200908081516.8561-2-dwagner@suse.de
Reviewed-by: Martin Wilck <mwilck@suse.com>
Reviewed-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/qla2xxx/qla_init.c
drivers/scsi/qla2xxx/qla_inline.h