kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Jason Yan d5534b2998 scsi: libsas: fix a race condition when smp task timeout 
commit b90cd6f2b9 upstream.

When the lldd is processing the complete sas task in interrupt and set the
task stat as SAS_TASK_STATE_DONE, the smp timeout timer is able to be
triggered at the same time. And smp_task_timedout() will complete the task
wheter the SAS_TASK_STATE_DONE is set or not. Then the sas task may freed
before lldd end the interrupt process. Thus a use-after-free will happen.

Fix this by calling the complete() only when SAS_TASK_STATE_DONE is not
set. And remove the check of the return value of the del_timer(). Once the
LLDD sets DONE, it must call task->done(), which will call
smp_task_done()->complete() and the task will be completed and freed
correctly.

Reported-by: chenxiang <chenxiang66@hisilicon.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
CC: John Garry <john.garry@huawei.com>
CC: Johannes Thumshirn <jthumshirn@suse.de>
CC: Ewan Milne <emilne@redhat.com>
CC: Christoph Hellwig <hch@lst.de>
CC: Tomas Henzl <thenzl@redhat.com>
CC: Dan Williams <dan.j.williams@intel.com>
CC: Hannes Reinecke <hare@suse.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: John Garry <john.garry@huawei.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-08-13 12:39:33 +01:00
..
accessibility printk: move braille console support into separate braille.[ch] files 2013-07-31 14:41:03 -07:00
acpi ACPICA: Namespace: remove address node from global list after method termination 2019-08-13 12:39:04 +01:00
amba ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
ata libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD 2019-05-02 21:41:40 +01:00
atm atm: zatm: Fix potential Spectre v1 2018-10-21 08:45:54 +01:00
auxdisplay auxdisplay: ks0108: fix refcount 2015-09-28 10:21:35 +01:00
base x86/speculation/mds: Add sysfs reporting for MDS 2019-05-22 23:15:23 +01:00
bcma bcma: use (get|put)_device when probing/removing device driver 2017-06-05 21:17:01 +01:00
block floppy: fix out-of-bounds read in copy_buffer 2019-08-13 12:39:27 +01:00
bluetooth Bluetooth: hci_uart: check for missing tty operations 2019-08-13 12:39:25 +01:00
bus bus: mbus: fix window size calculation for 4GB windows 2018-01-01 20:51:52 +00:00
cdrom cdrom: fix improper type cast, which can leat to information leak. 2018-12-16 22:09:46 +00:00
char tpm: Fix off-by-one when reading binary_bios_measurements 2019-07-09 22:04:00 +01:00
clk clk: dove: fix refcount leak in dove_clk_init() 2019-07-09 22:03:42 +01:00
clocksource clocksource/drivers/exynos_mct: Fix error path in timer resources initialization 2019-07-09 22:04:06 +01:00
connector connector: bump skb->users before callback invocation 2016-01-28 10:14:29 +00:00
cpufreq cpufreq: pxa2xx: remove incorrect __init annotation 2019-07-09 22:04:14 +01:00
cpuidle cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter() 2016-08-22 22:38:01 +01:00
crypto crypto: mxs-dcp - Fix wait logic on chan threads 2018-12-16 22:09:28 +00:00
dca dca: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
devfreq PM / devfreq: Fix devfreq_add_device() when drivers are built as modules. 2019-02-11 17:53:24 +00:00
dio m68k: don't export static inline functions 2009-12-06 11:18:28 +01:00
dma dmaengine: dmatest: Abort test in case of mapping error 2019-05-02 21:41:37 +01:00
edac EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting 2019-02-11 17:53:23 +00:00
eisa Revert "EISA: Initialize device before its resources" 2014-01-17 14:57:29 -07:00
extcon extcon: palmas: Use devm_extcon_dev_allocate for extcon_dev 2014-04-29 09:52:12 +09:00
firewire firewire: net: fix fragmented datagram_size off-by-one 2017-02-23 03:54:28 +00:00
firmware iscsi_ibft: Fix missing break in switch statement 2019-07-09 22:04:00 +01:00
fmc Merge 3.14-rc5 into char-misc-next 2014-03-02 19:53:09 -08:00
gpio gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input 2019-08-13 12:38:52 +01:00
gpu drm/radeon/evergreen_cs: fix missing break in switch statement 2019-07-09 22:04:03 +01:00
hid HID: debug: fix the ring buffer implementation 2019-03-25 17:32:34 +00:00
hsi HSI: ssi_protocol: double free in ssip_pn_xmit() 2017-08-26 02:14:37 +01:00
hv Drivers: hv: vmbus: Check for ring when getting debug info 2019-05-02 21:41:16 +01:00
hwmon hwmon: (w83795) temp4_type has writable permission 2019-02-11 17:54:06 +00:00
hwspinlock A single patch from Vincent extending OMAP's hwspinlock support to OMAP5. 2013-05-07 14:01:27 -07:00
i2c i2c: cadence: Fix the hold bit setting 2019-05-02 21:41:55 +01:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide 2014-07-21 22:44:24 -07:00
idle intel_idle: fix IVT idle state table setting 2014-04-21 23:36:07 +02:00
iio iio: core: fix a possible circular locking dependency 2019-08-13 12:38:58 +01:00
infiniband IB/mlx4: Fix race condition between catas error reset and aliasguid flows 2019-08-13 12:38:42 +01:00
input Input: gtco - bounds check collection indent level 2019-08-13 12:39:25 +01:00
iommu iommu/amd: Set exclusion range correctly 2019-08-13 12:39:05 +01:00
ipack ipack: convert bus code to use dev_groups 2013-10-16 18:40:57 -07:00
irqchip irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code 2019-07-09 22:04:05 +01:00
isdn mISDN: avoid arch specific __builtin_return_address call 2017-11-11 13:33:52 +00:00
leds leds: lp55xx: fix null deref on firmware load failure 2019-07-09 22:04:01 +01:00
lguest x86: Clean up cr4 manipulation 2018-01-09 00:35:07 +00:00
macintosh via-cuda: Use spinlock_irq_save/restore instead of enable/disable_irq 2018-10-03 04:10:07 +01:00
mailbox drivers/mailbox/omap: make mbox->irq signed for error handling 2014-01-23 16:36:53 -08:00
mcb mcb: Fixed bar number assignment for the gdd 2016-08-22 22:37:53 +01:00
md dm: disable DISCARD if the underlying storage no longer supports it 2019-08-13 12:39:01 +01:00
media USB: core: Fix bug caused by duplicate interface PM usage counter 2019-08-13 12:39:12 +01:00
memory memory: mvebu-devbus: add a devbus, keep-config property 2014-04-29 13:17:10 +00:00
memstick memstick: rtsx_usb_ms: Manage runtime PM when accessing the device 2017-02-23 03:54:16 +00:00
message scsi: mptsas: Disable WRITE SAME 2018-10-21 08:45:31 +01:00
mfd mfd: tps6586x: Handle interrupts on suspend 2019-05-02 21:41:10 +01:00
misc genwqe: Fix size check 2019-04-04 16:13:58 +01:00
mmc mmc: omap: fix the maximum timeout setting 2019-07-09 22:04:06 +01:00
mtd mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer 2019-08-13 12:39:01 +01:00
net ipv4: hash net ptr into fragmentation bucket selection 2019-08-13 12:39:30 +01:00
nfc NFC: microread: Potential overflows in microread_target_discovered() 2014-10-05 13:41:05 -07:00
ntb ntb: Use pci_enable_msix_range() instead of pci_enable_msix() 2014-04-07 10:59:20 -07:00
nubus kernel/printk: use symbolic defines for console loglevels 2014-06-04 16:54:17 -07:00
of of: add helper to lookup compatible child node 2019-02-11 17:53:40 +00:00
oprofile oprofile, nmi-timer: Fix CPU hotplug callback registration 2014-03-20 13:43:46 +01:00
parisc parisc: Hide Diva-built-in serial aux and graphics card 2018-03-03 15:52:00 +00:00
parport parport_pc: fix find_superio io compare code, should use equal test. 2019-07-09 22:03:58 +01:00
pci PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller 2019-08-13 12:39:02 +01:00
pcmcia pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges 2019-02-11 17:53:24 +00:00
phy phy: sun4i-usb: Use spinlock to guard phyctl register access 2017-02-23 03:53:59 +00:00
pinctrl pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups 2019-07-09 22:03:59 +01:00
platform platform/x86: alienware-wmi: Correct a memory leak 2018-12-16 22:09:15 +00:00
pnp ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage 2015-07-15 10:01:34 +01:00
power power: supply: olpc_battery: correct the temperature units 2019-04-04 16:13:42 +01:00
powercap PowerCap: Fix an error code in powercap_register_zone() 2017-09-15 18:29:35 +01:00
pps pps: do not crash when failed to register 2016-11-20 01:16:57 +00:00
ps3 ps3-vuart: don't use PREPARE_WORK 2014-03-07 10:24:48 -05:00
ptp ptp: fix Spectre v1 vulnerability 2018-12-16 22:09:42 +00:00
pwm pwm: tiehrpwm: Fix disabling of output of PWMs 2018-12-16 22:08:13 +00:00
rapidio rapidio/tsi721_dma: fix failure to obtain transaction descriptor 2014-07-30 17:16:13 -07:00
regulator regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA 2019-07-09 22:04:08 +01:00
remoteproc remoteproc: avoid stack overflow in debugfs file 2016-01-05 12:08:23 +00:00
reset reset: sunxi: fix spinlock initialization 2015-01-22 16:33:34 +00:00
rpmsg A small pull request consisting of: 2013-05-07 14:02:00 -07:00
rtc rtc: pm8xxx: fix unintended sign extension 2019-07-09 22:03:56 +01:00
s390 scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices 2019-08-13 12:38:55 +01:00
sbus bbc-i2c: Fix BBC I2C envctrl on SunBlade 2000 2014-08-14 10:09:44 +08:00
scsi scsi: libsas: fix a race condition when smp task timeout 2019-08-13 12:39:33 +01:00
sfi SFI / ACPI: Fix warnings reported during builds with W=1 2013-12-07 01:24:33 +01:00
sh SH Driver Update for v3.16 2014-06-06 11:44:09 -07:00
sn Drivers: misc: remove __dev* attributes. 2013-01-03 15:57:16 -08:00
soc soc: qcom: fix of_device_id table 2014-05-26 21:27:09 +02:00
spi spi: omap-100k: Remove unused definitions 2019-05-11 15:22:47 +01:00
spmi spmi: Include OF based modalias in device uevent 2017-11-11 13:32:58 +00:00
ssb ssb: Fix error routine when fallback SPROM fails 2017-03-16 02:26:23 +00:00
staging usb: usbip: fix isoc packet num validation in get_pipe 2019-08-13 12:39:16 +01:00
target scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock 2019-07-09 22:03:54 +01:00
tc TC: Handle device_register() errors. 2014-06-26 10:48:23 +01:00
thermal thermal: rcar_thermal: Prevent doing work after unbind 2019-02-11 17:53:41 +00:00
tty serial: sh-sci: Fix setting SCSCR_TIE while transferring data 2019-08-13 12:38:47 +01:00
uio uio: Fix an Oops on load 2019-02-11 17:54:00 +00:00
usb USB: yurex: Fix protection fault after device removal 2019-08-13 12:39:15 +01:00
uwb uwb: properly check kthread_run return value 2018-01-01 20:51:31 +00:00
vfio vfio/type1: Limit DMA mappings per container 2019-05-02 21:42:03 +01:00
vhost vhost: scsi: add weight support 2019-08-13 12:39:24 +01:00
video omap2fb: Fix stack memory disclosure 2019-05-02 21:41:19 +01:00
virt drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl 2019-06-20 18:11:26 +01:00
virtio virtio_balloon: fix another race between migration and ballooning 2018-11-20 18:05:52 +00:00
vlynq drivers/vlynq/vlynq.c: fix another resource size off by 1 error 2014-01-23 16:36:55 -08:00
vme vme: Fix wrong pointer utilization in ca91cx42_slave_get 2017-03-16 02:26:56 +00:00
w1 USB: w1 ds2490: Fix bug caused by improper use of altsetting array 2019-08-13 12:39:15 +01:00
watchdog watchdog: f71808e_wdt: Fix WD_EN register read 2018-10-21 08:44:53 +01:00
xen xen: let alloc_xenballooned_pages() fail if not enough memory free 2019-08-13 12:39:28 +01:00
zorro zorro/UAPI: Use proper types (endianness/size) in <linux/zorro.h> 2013-11-26 11:09:09 +01:00
Kconfig soc: Introduce drivers/soc place-holder for SOC specific drivers 2014-05-23 11:37:46 -05:00
Makefile usb: Make sure usb/phy/of gets built-in 2017-08-26 02:14:39 +01:00