linux-kernel - Re: [PATCH v2] scsi: ufs: mcq: Add NULL check in ufshcd_mcq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3b0e14cb3162cc1bf6ccd3ccc5af7434da9960b2.camel@mediatek.com>
Date: Fri, 11 Apr 2025 02:41:13 +0000
From: Peter Wang (王信友) <peter.wang@...iatek.com>
To: "avri.altman@....com" <avri.altman@....com>, "quic_cang@...cinc.com"
	<quic_cang@...cinc.com>, "cw9316.lee@...sung.com" <cw9316.lee@...sung.com>,
	"quic_nguyenb@...cinc.com" <quic_nguyenb@...cinc.com>, "bvanassche@....org"
	<bvanassche@....org>, "manivannan.sadhasivam@...aro.org"
	<manivannan.sadhasivam@...aro.org>, "alim.akhtar@...sung.com"
	<alim.akhtar@...sung.com>, "chenyuan0y@...il.com" <chenyuan0y@...il.com>,
	"minwoo.im@...sung.com" <minwoo.im@...sung.com>, "viro@...iv.linux.org.uk"
	<viro@...iv.linux.org.uk>, "martin.petersen@...cle.com"
	<martin.petersen@...cle.com>, "James.Bottomley@...senPartnership.com"
	<James.Bottomley@...senPartnership.com>,
	Stanley Chu (朱原陞) <stanley.chu@...iatek.com>
CC: "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()

On Wed, 2025-04-09 at 19:13 -0500, Chenyuan Yang wrote:
> 
> A race can occur between the MCQ completion path and the abort
> handler:
> once a request completes, __blk_mq_free_request() sets rq->mq_hctx to
> NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in
> ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is
> dereferenced, the kernel will crash.
> 
> Add a NULL check for the returned hwq pointer. If hwq is NULL, log an
> error and return FAILED, preventing a potential NULL-pointer
> dereference.
> As suggested by Bart, the ufshcd_cmd_inflight() check is removed.
> 
> This is similar to the fix in commit 74736103fb41
> ("scsi: ufs: core: Fix ufshcd_abort_one racing issue").
> 
> This is found by our static analysis tool KNighter.
> 
> Signed-off-by: Chenyuan Yang <chenyuan0y@...il.com>
> Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()")
> ---
>  drivers/ufs/core/ufs-mcq.c | 12 +++++-------
>  1 file changed, 5 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
> index 240ce135bbfb..f1294c29f484 100644
> --- a/drivers/ufs/core/ufs-mcq.c
> +++ b/drivers/ufs/core/ufs-mcq.c
> @@ -677,13 +677,6 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
>         unsigned long flags;
>         int err;
> 
> -       if (!ufshcd_cmd_inflight(lrbp->cmd)) {
> -               dev_err(hba->dev,
> -                       "%s: skip abort. cmd at tag %d already
> completed.\n",
> -                       __func__, tag);
> -               return FAILED;
> -       }
> -
>         /* Skip task abort in case previous aborts failed and report
> failure */
>         if (lrbp->req_abort_skip) {
>                 dev_err(hba->dev, "%s: skip abort. tag %d failed
> earlier\n",
> @@ -692,6 +685,11 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd)
>         }
> 
>         hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd));
> +       if (!hwq) {
> +               dev_err(hba->dev, "%s: skip abort. cmd at tag %d
> already completed.\n",
> +                       __func__, tag);
> +               return FAILED;
> +       }
> 
>         if (ufshcd_mcq_sqe_search(hba, hwq, tag)) {
>                 /*
> --
> 2.34.1
> 

Reviewed-by: Peter Wang <peter.wang@...iatek.com>