linux-kernel - [PATCH] scsi: ufs: core: Do not access null point in ufshpb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230920091226.55663-1-zhanghui31@xiaomi.com>
Date:   Wed, 20 Sep 2023 17:12:26 +0800
From:   Zhang Hui <masonzhang.xiaomi@...il.com>
To:     alim.akhtar@...sung.com, avri.altman@....com, bvanassche@....org,
        jejb@...ux.ibm.com, martin.petersen@...cle.com
Cc:     linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        stanley.chu@...iatek.com, peng.zhou@...iatek.com,
        yujiaochen@...omi.com, yudongbin@...omi.com, zhanghui31@...omi.com
Subject: [PATCH] scsi: ufs: core: Do not access null point in ufshpb_remove

From: zhanghui <zhanghui31@...omi.com>

If hpb is not enabled or not allowed, some points will not be allocated in
init flow, so access them will trigger KE in ufshpb remove flow.

Call trace in rmmod ko:
destroy_workqueue+0x1c/0x234
ufshpb_remove+0x40/0x50
ufshcd_remove+0x3c/0xd0
...

Signed-off-by: zhanghui <zhanghui31@...omi.com>
---
 drivers/ufs/core/ufshpb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/ufs/core/ufshpb.c b/drivers/ufs/core/ufshpb.c
index 255f8b38d0c2..fa345e161cb8 100644
--- a/drivers/ufs/core/ufshpb.c
+++ b/drivers/ufs/core/ufshpb.c
@@ -2656,6 +2656,9 @@ void ufshpb_init(struct ufs_hba *hba)
 
 void ufshpb_remove(struct ufs_hba *hba)
 {
+	if (!ufshpb_is_allowed(hba) || !hba->dev_info.hpb_enabled)
+		return;
+
 	mempool_destroy(ufshpb_page_pool);
 	mempool_destroy(ufshpb_mctx_pool);
 	kmem_cache_destroy(ufshpb_mctx_cache);
-- 
2.34.1