linux-kernel - [PATCH] mpt3sas: Fix leaked raid template in _mpt3sas

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu, 3 Nov 2022 17:24:04 +0800
From:   Chen Zhongjin <chenzhongjin@...wei.com>
To:     <linux-kernel@...r.kernel.org>, <MPT-FusionLinux.pdl@...adcom.com>,
        <linux-scsi@...r.kernel.org>
CC:     <sathya.prakash@...adcom.com>, <sreekanth.reddy@...adcom.com>,
        <suganath-prabu.subramani@...adcom.com>, <jejb@...ux.ibm.com>,
        <martin.petersen@...cle.com>, <hare@...e.de>,
        <chenzhongjin@...wei.com>
Subject: [PATCH] mpt3sas: Fix leaked raid template in _mpt3sas_init()

In _mpt3sas_init(), when attaching mpt2sas raid functions template and
fails, mpt3sas template is not released.

raid_class_attach() calls attribute_container_register() and add list
node to attribute_container_list. If it is not unregistered and removed,
when iterating the list in other modules, already released memory
&mpt3sas_raid_functions will be accessed and cause kernel panic:

BUG: unable to handle page fault for address: fffffbfff80dd520
CPU: 0 PID: 390 Comm: modprobe
Hardware name: QEMU Standard PC
RIP: 0010:raid_match+0x65/0x150 [raid_class]
...
Call Trace:
 <TASK>
 attribute_container_add_device+0x124/0x320
 scsi_sysfs_device_initialize+0x421/0x9b0
 scsi_alloc_sdev+0x98b/0xcc0
 scsi_probe_and_add_lun+0x18bf/0x29b0
 ...

Fix it by calling raid_class_release() to release mpt3sas template in
mpt2sas register error path.

Fixes: c84b06a48c4d ("mpt3sas: Single driver module which supports both SAS 2.0 & SAS 3.0 HBAs")
Signed-off-by: Chen Zhongjin <chenzhongjin@...wei.com>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 8e24ebcebfe5..e20929bc3766 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -12900,6 +12900,8 @@ _mpt3sas_init(void)
 		mpt2sas_raid_template =
 				raid_class_attach(&mpt2sas_raid_functions);
 		if (!mpt2sas_raid_template) {
+			if (hbas_to_enumerate != 1)
+				raid_class_release(mpt3sas_raid_template);
 			sas_release_transport(mpt3sas_transport_template);
 			return -ENODEV;
 		}
-- 
2.17.1