linux-kernel - Re: smp-induced oops/NULL pointer dereference in mpt3sas, from kernel >= 4.11

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1502985717.2615.11.camel@wdc.com>
Date:   Thu, 17 Aug 2017 16:02:00 +0000
From:   Bart Van Assche <Bart.VanAssche@....com>
To:     "chaitra.basappa@...adcom.com" <chaitra.basappa@...adcom.com>,
        "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     "sathya.prakash@...adcom.com" <sathya.prakash@...adcom.com>,
        "sreekanth.reddy@...adcom.com" <sreekanth.reddy@...adcom.com>,
        "suganath-prabu.subramani@...adcom.com" 
        <suganath-prabu.subramani@...adcom.com>,
        "kashyap.desai@...adcom.com" <kashyap.desai@...adcom.com>
Subject: Re: smp-induced oops/NULL pointer dereference in mpt3sas, from kernel
 >= 4.11

On Thu, 2017-08-17 at 15:18 +0530, Chaitra Basappa wrote:
> We analyzed this issue and could figure out it is not because of driver,
> its because the "sense" field of the 'struct scsi_request' is not being
> populated properly from the upper layer.
> And this "sense" member is being referenced in our driver code for kernel
> versions >= 4.11 as shown below in the snippet:
> Whereas as for < 4.11 kernel version this "sense" member was referenced
> via 'struct request'
> 
> 
> static int
> _transport_smp_handler (.....) {
> .....
> .....
> > > memcpy(scsi_req(req)->sense, mpi_reply, sizeof(*mpi_reply));
> 
> .....
> .....
> }
> 
> And hence the NULL pointer dereference call trace is seen for the above
> chunk of mpt3sas. This needs to be addressed from upper layer, so please
> help us in getting this resolved.

Hello Chaitra,

Have you noticed the following e-mail thread: "[RFC PATCH 0/6] bsg: fix
regression resulting in panics when sending commands via BSG and some
sanity cleanups" (http://www.spinics.net/lists/linux-scsi/msg111724.html)?

Bart.