kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers/scsi/bfa
History
Ye Bin c28409f851 scsi: bfa: Fix use-after-free in bfad_im_module_exit() 
[ Upstream commit 178b8f3893 ]

BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20
Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303

Call Trace:
 <TASK>
 dump_stack_lvl+0x95/0xe0
 print_report+0xcb/0x620
 kasan_report+0xbd/0xf0
 __lock_acquire+0x2aca/0x3a20
 lock_acquire+0x19b/0x520
 _raw_spin_lock+0x2b/0x40
 attribute_container_unregister+0x30/0x160
 fc_release_transport+0x19/0x90 [scsi_transport_fc]
 bfad_im_module_exit+0x23/0x60 [bfa]
 bfad_init+0xdb/0xff0 [bfa]
 do_one_initcall+0xdc/0x550
 do_init_module+0x22d/0x6b0
 load_module+0x4e96/0x5ff0
 init_module_from_file+0xcd/0x130
 idempotent_init_module+0x330/0x620
 __x64_sys_finit_module+0xb3/0x110
 do_syscall_64+0xc1/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Allocated by task 25303:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 __kasan_kmalloc+0x7f/0x90
 fc_attach_transport+0x4f/0x4740 [scsi_transport_fc]
 bfad_im_module_init+0x17/0x80 [bfa]
 bfad_init+0x23/0xff0 [bfa]
 do_one_initcall+0xdc/0x550
 do_init_module+0x22d/0x6b0
 load_module+0x4e96/0x5ff0
 init_module_from_file+0xcd/0x130
 idempotent_init_module+0x330/0x620
 __x64_sys_finit_module+0xb3/0x110
 do_syscall_64+0xc1/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 25303:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 kasan_save_free_info+0x3b/0x60
 __kasan_slab_free+0x38/0x50
 kfree+0x212/0x480
 bfad_im_module_init+0x7e/0x80 [bfa]
 bfad_init+0x23/0xff0 [bfa]
 do_one_initcall+0xdc/0x550
 do_init_module+0x22d/0x6b0
 load_module+0x4e96/0x5ff0
 init_module_from_file+0xcd/0x130
 idempotent_init_module+0x330/0x620
 __x64_sys_finit_module+0xb3/0x110
 do_syscall_64+0xc1/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Above issue happens as follows:

bfad_init
  error = bfad_im_module_init()
    fc_release_transport(bfad_im_scsi_transport_template);
  if (error)
    goto ext;

ext:
  bfad_im_module_exit();
    fc_release_transport(bfad_im_scsi_transport_template);
    --> Trigger double release

Don't call bfad_im_module_exit() if bfad_im_module_init() failed.

Fixes: 7725ccfda5 ("[SCSI] bfa: Brocade BFA FC SCSI driver")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-12-09 10:32:18 +01:00
..
bfa.h scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn 2024-03-26 18:20:01 -04:00
bfa_core.c scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn 2024-03-26 18:20:01 -04:00
bfa_cs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_defs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_defs_fcs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_defs_svc.h scsi: bfa: Fix typo 2021-05-21 17:00:21 -04:00
bfa_fc.h scsi: bfa: Replace one-element array with flexible-array member in struct fc_rscn_pl_s 2023-08-21 17:13:56 -04:00
bfa_fcbuild.c scsi: bfa: Replace one-element array with flexible-array member in struct fc_rscn_pl_s 2023-08-21 17:13:56 -04:00
bfa_fcbuild.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_fcpim.c scsi: bfa: Drop driver-defined SCSI status codes 2021-01-22 21:14:08 -05:00
bfa_fcpim.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_fcs.c scsi: bfa: Replace all non-returning strlcpy() with strscpy() 2023-05-16 21:38:36 -04:00
bfa_fcs.h scsi: bfa: Remove unnecessary struct declarations 2021-04-05 23:44:01 -04:00
bfa_fcs_fcpim.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_fcs_lport.c scsi: bfa: Replace all non-returning strlcpy() with strscpy() 2023-05-16 21:38:36 -04:00
bfa_fcs_rport.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
bfa_hw_cb.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_hw_ct.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_ioc.c scsi: bfa: Replace all non-returning strlcpy() with strscpy() 2023-05-16 21:38:36 -04:00
bfa_ioc.h scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn 2024-03-26 18:20:01 -04:00
bfa_ioc_cb.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_ioc_ct.c scsi: bfa: Demote non-compliant kerneldoc headers to standard comments 2020-07-24 22:32:07 -04:00
bfa_modules.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_plog.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_port.c scsi: bfa: Staticify local functions 2020-07-24 22:31:56 -04:00
bfa_port.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfa_svc.c scsi: bfa: Replace all non-returning strlcpy() with strscpy() 2023-05-16 21:38:36 -04:00
bfa_svc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfad.c scsi: bfa: Fix use-after-free in bfad_im_module_exit() 2024-12-09 10:32:18 +01:00
bfad_attr.c scsi: bfa: Replace all non-returning strlcpy() with strscpy() 2023-05-16 21:38:36 -04:00
bfad_bsg.c scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn 2024-03-26 18:20:01 -04:00
bfad_bsg.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfad_debugfs.c scsi: bfa: Ensure the copied buf is NUL terminated 2024-06-12 11:11:49 +02:00
bfad_drv.h scsi: bfa: Drop redundant pci_enable_pcie_error_reporting() 2023-03-09 22:00:38 -05:00
bfad_im.c scsi: bfa: Replace all non-returning strlcpy() with strscpy() 2023-05-16 21:38:36 -04:00
bfad_im.h scsi: bfa: Convert bfad_reset_sdev_bflags() from a macro into a function 2022-11-08 03:34:39 +00:00
bfi.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfi_ms.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
bfi_reg.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 292 2019-06-05 17:36:38 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00