linux-kernel - Re: [PATCH] scsi: pm8001: Fix potential TOCTOU race in pm8001_find

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAAo+4rVW=CNyf1g6Gmnxi_te87Qn2oGYOEDgEyDOJFVzpFuCvA@mail.gmail.com>
Date: Mon, 19 Jan 2026 23:24:20 +0800
From: Chengfeng Ye <dg573847474@...il.com>
To: "James E . J . Bottomley" <James.Bottomley@...senpartnership.com>, 
	"Martin K . Petersen" <martin.petersen@...cle.com>, Jack Wang <jinpu.wang@...ud.ionos.com>
Cc: linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: pm8001: Fix potential TOCTOU race in pm8001_find_tag

>  drivers/scsi/pm8001/pm8001_sas.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
> index 6a8d35aea93a..2d73e65db4c0 100644
> --- a/drivers/scsi/pm8001/pm8001_sas.c
> +++ b/drivers/scsi/pm8001/pm8001_sas.c
> @@ -49,9 +49,10 @@
>   */
>  static int pm8001_find_tag(struct sas_task *task, u32 *tag)
>  {
> -       if (task->lldd_task) {
> -               struct pm8001_ccb_info *ccb;
> -               ccb = task->lldd_task;
> +       struct pm8001_ccb_info *ccb;
> +
> +       ccb = READ_ONCE(task->lldd_task);
> +       if (ccb) {
>                 *tag = ccb->ccb_tag;
>                 return 1;
>         }
> @@ -617,7 +618,7 @@ void pm8001_ccb_task_free(struct pm8001_hba_info *pm8001_ha,
>                         pm8001_dev ? atomic_read(&pm8001_dev->running_req) : -1);
>         }
>
> -       task->lldd_task = NULL;
> +       WRITE_ONCE(task->lldd_task, NULL);
>         pm8001_ccb_free(pm8001_ha, ccb);
>  }
>
> --
> 2.25.1
>

> Fix this by using READ_ONCE() to read task->lldd_task exactly once,
> eliminating the TOCTOU window. Also use WRITE_ONCE() in
> pm8001_ccb_task_free() for proper memory ordering.

It just hit me that the patch can only eliminate the race on
task->lldd_task but cannot guarantee cbb has not released by
pm8001_ccb_free(pm8001_ha, ccb) when accssed. Maybe we still require a
lock synchronization?

Chengfeng