linux-kernel - [PATCH] scsi: qla2xx: Fix double free in qla2x00_probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 26 Apr 2022 09:40:30 +0000
From:   Keita Suzuki <keitasuzuki.park@...ab.ics.keio.ac.jp>
To:     unlisted-recipients:; (no To-header on input)
Cc:     sdeodhar@...vell.com, aeasi@...vell.com,
        Keita Suzuki <keitasuzuki.park@...ab.ics.keio.ac.jp>,
        stable@...r.kernel.org, Nilesh Javali <njavali@...vell.com>,
        GR-QLogic-Storage-Upstream@...vell.com,
        "James E.J. Bottomley" <jejb@...ux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Himanshu Madhani <himanshu.madhani@...ium.com>,
        Quinn Tran <quinn.tran@...ium.com>,
        James Bottomley <James.Bottomley@...senPartnership.com>,
        Andrew Vasquez <andrew.vasquez@...gic.com>,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] scsi: qla2xx: Fix double free in qla2x00_probe_one()

In qla2x00_probe_one() -> qla2x00_mem_alloc(), fields in variable ha
is allocated and initialized. Fields ha->loop_id_map and ha->npiv_info
are also allocated in this function, but are freed when the function
encounters an error. Function qla2x00_probe_one() then calls
qla2x00_mem_free() to handle the error, which frees the corresponding
fields again. This results in double free of ha->loop_id_map and ha->
npiv_info, since the fields are not NULLed after freed the first time.

Fix this by storing NULL to the corresponding fields inside
qla2x00_mem_alloc() error handlers.

Fixes: e4e3a2ce9556 ("scsi: qla2xxx: Add ability to autodetect SFP type")
Fixes: b64b0e8fd964 ("[SCSI] qla2xxx: Pass in optional extended-initialization control block.")
Cc: stable@...r.kernel.org
Signed-off-by: Keita Suzuki <keitasuzuki.park@...ab.ics.keio.ac.jp>
---
 drivers/scsi/qla2xxx/qla_os.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 762229d495a8..a0b40578dbc8 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -4396,6 +4396,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
 	    ha->sfp_data, ha->sfp_data_dma);
 fail_sfp_data:
 	kfree(ha->loop_id_map);
+	ha->loop_id_map = NULL;
 fail_loop_id_map:
 	dma_pool_free(ha->s_dma_pool, ha->async_pd, ha->async_pd_dma);
 fail_async_pd:
@@ -4404,6 +4405,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
 	dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma);
 fail_ex_init_cb:
 	kfree(ha->npiv_info);
+	ha->npiv_info = NULL;
 fail_npiv_info:
 	dma_free_coherent(&ha->pdev->dev, ((*rsp)->length + 1) *
 		sizeof(response_t), (*rsp)->ring, (*rsp)->dma);
-- 
2.25.1