[PATCH 0/2] fix some bsg related bugs

[PATCH 0/2] fix some bsg related bugs

[Guixin Liu]

Guixin Liu (2):
  scsi: ufs: delete bsg_dev when setup bsg fail
  scsi: ufs: set bsg_queue to NULL after remove

 drivers/ufs/core/ufs_bsg.c | 2 ++
 1 file changed, 2 insertions(+)

-- 
2.43.0

[PATCH 1/2] scsi: ufs: delete bsg_dev when setup bsg fail

[Guixin Liu]

We should remove the bsg device when bsg_setup_queue() return fail
to release the resources.

Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/ufs/core/ufs_bsg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 6c09d97ae006..58023f735c19 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -257,6 +257,7 @@ int ufs_bsg_probe(struct ufs_hba *hba)
 			NULL, 0);
 	if (IS_ERR(q)) {
 		ret = PTR_ERR(q);
+		device_del(bsg_dev);
 		goto out;
 	}
 
-- 
2.43.0

[PATCH 2/2] scsi: ufs: set bsg_queue to NULL after remove

[Guixin Liu]

Currently, this does not cause any issues, but I believe it is
necessary to set bsg_queue to NULL after removing it to prevent
potential use-after-free (UAF) access.

Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/ufs/core/ufs_bsg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 58023f735c19..8d4ad0a3f2cf 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -216,6 +216,7 @@ void ufs_bsg_remove(struct ufs_hba *hba)
 		return;
 
 	bsg_remove_queue(hba->bsg_queue);
+	hba->bsg_queue = NULL;
 
 	device_del(bsg_dev);
 	put_device(bsg_dev);
-- 
2.43.0

RE: [PATCH 2/2] scsi: ufs: set bsg_queue to NULL after remove

[Avri Altman]

> 
> Currently, this does not cause any issues, but I believe it is necessary to set
> bsg_queue to NULL after removing it to prevent potential use-after-free (UAF)
> access.
OK.

> 
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>

> ---
>  drivers/ufs/core/ufs_bsg.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index
> 58023f735c19..8d4ad0a3f2cf 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -216,6 +216,7 @@ void ufs_bsg_remove(struct ufs_hba *hba)
>                 return;
> 
>         bsg_remove_queue(hba->bsg_queue);
> +       hba->bsg_queue = NULL;
> 
>         device_del(bsg_dev);
>         put_device(bsg_dev);
> --
> 2.43.0

RE: [PATCH 1/2] scsi: ufs: delete bsg_dev when setup bsg fail

[Avri Altman]

> We should remove the bsg device when bsg_setup_queue() return fail to
> release the resources.
> 


Fixes: 
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Once added, please add my Reviewed-by.

Thanks,
Avri

> ---
>  drivers/ufs/core/ufs_bsg.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index
> 6c09d97ae006..58023f735c19 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -257,6 +257,7 @@ int ufs_bsg_probe(struct ufs_hba *hba)
>                         NULL, 0);
>         if (IS_ERR(q)) {
>                 ret = PTR_ERR(q);
> +               device_del(bsg_dev);
>                 goto out;
>         }
> 
> --
> 2.43.0