* [PATCH 0/2] fix some bsg related bugs
@ 2024-12-17 10:58 Guixin Liu
2024-12-17 10:58 ` [PATCH 1/2] scsi: ufs: delete bsg_dev when setup bsg fail Guixin Liu
2024-12-17 10:58 ` [PATCH 2/2] scsi: ufs: set bsg_queue to NULL after remove Guixin Liu
0 siblings, 2 replies; 5+ messages in thread
From: Guixin Liu @ 2024-12-17 10:58 UTC (permalink / raw)
To: Alim Akhtar, Avri Altman, Bart Van Assche,
James E . J . Bottomley, Martin K . Petersen
Cc: linux-scsi
Guixin Liu (2):
scsi: ufs: delete bsg_dev when setup bsg fail
scsi: ufs: set bsg_queue to NULL after remove
drivers/ufs/core/ufs_bsg.c | 2 ++
1 file changed, 2 insertions(+)
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 1/2] scsi: ufs: delete bsg_dev when setup bsg fail
2024-12-17 10:58 [PATCH 0/2] fix some bsg related bugs Guixin Liu
@ 2024-12-17 10:58 ` Guixin Liu
2024-12-17 11:33 ` Avri Altman
2024-12-17 10:58 ` [PATCH 2/2] scsi: ufs: set bsg_queue to NULL after remove Guixin Liu
1 sibling, 1 reply; 5+ messages in thread
From: Guixin Liu @ 2024-12-17 10:58 UTC (permalink / raw)
To: Alim Akhtar, Avri Altman, Bart Van Assche,
James E . J . Bottomley, Martin K . Petersen
Cc: linux-scsi
We should remove the bsg device when bsg_setup_queue() return fail
to release the resources.
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
drivers/ufs/core/ufs_bsg.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 6c09d97ae006..58023f735c19 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -257,6 +257,7 @@ int ufs_bsg_probe(struct ufs_hba *hba)
NULL, 0);
if (IS_ERR(q)) {
ret = PTR_ERR(q);
+ device_del(bsg_dev);
goto out;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* RE: [PATCH 1/2] scsi: ufs: delete bsg_dev when setup bsg fail
2024-12-17 10:58 ` [PATCH 1/2] scsi: ufs: delete bsg_dev when setup bsg fail Guixin Liu
@ 2024-12-17 11:33 ` Avri Altman
0 siblings, 0 replies; 5+ messages in thread
From: Avri Altman @ 2024-12-17 11:33 UTC (permalink / raw)
To: Guixin Liu, Alim Akhtar, Bart Van Assche, James E . J . Bottomley,
Martin K . Petersen
Cc: linux-scsi@vger.kernel.org
> We should remove the bsg device when bsg_setup_queue() return fail to
> release the resources.
>
Fixes:
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Once added, please add my Reviewed-by.
Thanks,
Avri
> ---
> drivers/ufs/core/ufs_bsg.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index
> 6c09d97ae006..58023f735c19 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -257,6 +257,7 @@ int ufs_bsg_probe(struct ufs_hba *hba)
> NULL, 0);
> if (IS_ERR(q)) {
> ret = PTR_ERR(q);
> + device_del(bsg_dev);
> goto out;
> }
>
> --
> 2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 2/2] scsi: ufs: set bsg_queue to NULL after remove
2024-12-17 10:58 [PATCH 0/2] fix some bsg related bugs Guixin Liu
2024-12-17 10:58 ` [PATCH 1/2] scsi: ufs: delete bsg_dev when setup bsg fail Guixin Liu
@ 2024-12-17 10:58 ` Guixin Liu
2024-12-17 11:32 ` Avri Altman
1 sibling, 1 reply; 5+ messages in thread
From: Guixin Liu @ 2024-12-17 10:58 UTC (permalink / raw)
To: Alim Akhtar, Avri Altman, Bart Van Assche,
James E . J . Bottomley, Martin K . Petersen
Cc: linux-scsi
Currently, this does not cause any issues, but I believe it is
necessary to set bsg_queue to NULL after removing it to prevent
potential use-after-free (UAF) access.
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
drivers/ufs/core/ufs_bsg.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 58023f735c19..8d4ad0a3f2cf 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -216,6 +216,7 @@ void ufs_bsg_remove(struct ufs_hba *hba)
return;
bsg_remove_queue(hba->bsg_queue);
+ hba->bsg_queue = NULL;
device_del(bsg_dev);
put_device(bsg_dev);
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* RE: [PATCH 2/2] scsi: ufs: set bsg_queue to NULL after remove
2024-12-17 10:58 ` [PATCH 2/2] scsi: ufs: set bsg_queue to NULL after remove Guixin Liu
@ 2024-12-17 11:32 ` Avri Altman
0 siblings, 0 replies; 5+ messages in thread
From: Avri Altman @ 2024-12-17 11:32 UTC (permalink / raw)
To: Guixin Liu, Alim Akhtar, Bart Van Assche, James E . J . Bottomley,
Martin K . Petersen
Cc: linux-scsi@vger.kernel.org
>
> Currently, this does not cause any issues, but I believe it is necessary to set
> bsg_queue to NULL after removing it to prevent potential use-after-free (UAF)
> access.
OK.
>
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
> ---
> drivers/ufs/core/ufs_bsg.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index
> 58023f735c19..8d4ad0a3f2cf 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -216,6 +216,7 @@ void ufs_bsg_remove(struct ufs_hba *hba)
> return;
>
> bsg_remove_queue(hba->bsg_queue);
> + hba->bsg_queue = NULL;
>
> device_del(bsg_dev);
> put_device(bsg_dev);
> --
> 2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-12-17 11:33 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-17 10:58 [PATCH 0/2] fix some bsg related bugs Guixin Liu
2024-12-17 10:58 ` [PATCH 1/2] scsi: ufs: delete bsg_dev when setup bsg fail Guixin Liu
2024-12-17 11:33 ` Avri Altman
2024-12-17 10:58 ` [PATCH 2/2] scsi: ufs: set bsg_queue to NULL after remove Guixin Liu
2024-12-17 11:32 ` Avri Altman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.