linux-kernel - Re: [PATCH v2] scsi: ufs: mcq: Add NULL check in ufshcd_mcq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <174445370235.1751018.17269242214304693746.b4-ty@oracle.com>
Date: Sat, 12 Apr 2025 06:28:53 -0400
From: "Martin K. Petersen" <martin.petersen@...cle.com>
To: alim.akhtar@...sung.com, avri.altman@....com, bvanassche@....org,
        James.Bottomley@...senPartnership.com, peter.wang@...iatek.com,
        minwoo.im@...sung.com, manivannan.sadhasivam@...aro.org,
        viro@...iv.linux.org.uk, cw9316.lee@...sung.com,
        quic_nguyenb@...cinc.com, quic_cang@...cinc.com,
        stanley.chu@...iatek.com, Chenyuan Yang <chenyuan0y@...il.com>
Cc: "Martin K . Petersen" <martin.petersen@...cle.com>,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()

On Wed, 09 Apr 2025 19:13:20 -0500, Chenyuan Yang wrote:

> A race can occur between the MCQ completion path and the abort handler:
> once a request completes, __blk_mq_free_request() sets rq->mq_hctx to
> NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in
> ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is
> dereferenced, the kernel will crash.
> 
> Add a NULL check for the returned hwq pointer. If hwq is NULL, log an
> error and return FAILED, preventing a potential NULL-pointer dereference.
> As suggested by Bart, the ufshcd_cmd_inflight() check is removed.
> 
> [...]

Applied to 6.15/scsi-fixes, thanks!

[1/1] scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
      https://git.kernel.org/mkp/scsi/c/4c3240850629

-- 
Martin K. Petersen	Oracle Linux Engineering