linux-kernel - Re: [PATCH v2] scsi: ufs: mcq: Add NULL check in ufshcd_mcq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5c4b5e2e-eac1-4be5-bf72-2c151979a5cf@acm.org>
Date: Thu, 10 Apr 2025 13:46:21 -0700
From: Bart Van Assche <bvanassche@....org>
To: Chenyuan Yang <chenyuan0y@...il.com>, alim.akhtar@...sung.com,
 avri.altman@....com, James.Bottomley@...senPartnership.com,
 martin.petersen@...cle.com, peter.wang@...iatek.com, minwoo.im@...sung.com,
 manivannan.sadhasivam@...aro.org, viro@...iv.linux.org.uk,
 cw9316.lee@...sung.com, quic_nguyenb@...cinc.com, quic_cang@...cinc.com,
 stanley.chu@...iatek.com
Cc: linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()

On 4/9/25 5:13 PM, Chenyuan Yang wrote:
> A race can occur between the MCQ completion path and the abort handler:
> once a request completes, __blk_mq_free_request() sets rq->mq_hctx to
> NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in
> ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is
> dereferenced, the kernel will crash.
> 
> Add a NULL check for the returned hwq pointer. If hwq is NULL, log an
> error and return FAILED, preventing a potential NULL-pointer dereference.
> As suggested by Bart, the ufshcd_cmd_inflight() check is removed.
> 
> This is similar to the fix in commit 74736103fb41
> ("scsi: ufs: core: Fix ufshcd_abort_one racing issue").
> 
> This is found by our static analysis tool KNighter.
Reviewed-by: Bart Van Assche <bvanassche@....org>