linux-kernel - Re: [PATCH] drivers/scsi/qla2xxx: fix double free bug after firmware timeout

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180115203726.b7igf7rajczllcv7@rabbit.intern.cm-ag>
Date:   Mon, 15 Jan 2018 21:37:27 +0100
From:   Max Kellermann <mk@...all.com>
To:     "Madhani, Himanshu" <Himanshu.Madhani@...ium.com>
Cc:     Max Kellermann <mk@...all.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        linux-scsi <linux-scsi@...r.kernel.org>,
        Dept-Eng QLA2xxx Upstream <qla2xxx-upstream@...ium.com>,
        "max.kellermann@...il.com" <max.kellermann@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drivers/scsi/qla2xxx: fix double free bug after firmware
 timeout

On 2018/01/15 20:58, "Madhani, Himanshu" <Himanshu.Madhani@...ium.com> wrote:
> We have patch to prevent this double free in 4.16/scsi-queue
> already.

No, let me repeat: this is a different bug!

Your bug is about the free call after waiting for completion
synchronously in qla24xx_els_dcmd_iocb(), after it was already freed
by qla2x00_sp_timeout().

My bug is about free in qla2x00_*_sp_done() and again in
qla2x00_sp_timeout().  My patch description describes exactly that.

And you know what?  My patch fixes both bugs.  It is superior to the
one that was merged 4 weeks later, isn't it?

You NACKed my patch 5 weeks ago, and I explained to you that you were
talking about a different bug, but you never replied to that.

Max