]> git.baikalelectronics.ru Git - kernel.git/commit
scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send
authorSteffen Maier <maier@linux.vnet.ibm.com>
Wed, 8 Feb 2017 14:34:22 +0000 (15:34 +0100)
committerMartin K. Petersen <martin.petersen@oracle.com>
Fri, 10 Feb 2017 00:28:19 +0000 (19:28 -0500)
commit8c26346c690616a9f7423d339a3d43f5220c3d51
treeb0d4f8150f5e0bb5581ebf521182420b5158332b
parent80ec4c1b2bfc76455e17a31e3aa9ad6b75215faf
scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send

Dan Carpenter kindly reported:
<quote>
The patch c064a027ccb9: "zfcp: trace on request for open and close of
WKA port" from Aug 10, 2016, leads to the following static checker
warning:

drivers/s390/scsi/zfcp_fsf.c:1615 zfcp_fsf_open_wka_port()
warn: 'req' was already freed.

drivers/s390/scsi/zfcp_fsf.c
  1609          zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
  1610          retval = zfcp_fsf_req_send(req);
  1611          if (retval)
  1612                  zfcp_fsf_req_free(req);
                                          ^^^
Freed.

  1613  out:
  1614          spin_unlock_irq(&qdio->req_q_lock);
  1615          if (req && !IS_ERR(req))
  1616                  zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
                                                                  ^^^^^^^^^^^
Use after free.

  1617          return retval;
  1618  }

Same thing for zfcp_fsf_close_wka_port() as well.
</quote>

Rather than relying on req being NULL (or ERR_PTR) for all cases where
we don't want to trace or should not trace,
simply check retval which is unconditionally initialized with -EIO != 0
and it can only become 0 on successful retval = zfcp_fsf_req_send(req).
With that we can also remove the then again unnecessary unconditional
initialization of req which was introduced with that earlier commit.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Suggested-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Fixes: c064a027ccb9 ("zfcp: trace on request for open and close of WKA port")
Cc: <stable@vger.kernel.org> #2.6.38+
Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/s390/scsi/zfcp_fsf.c