* Re: [PATCH] scsi: qla2xxx: Fix use after free in debug code
2021-08-03 15:56 [PATCH] scsi: qla2xxx: Fix use after free in debug code Dan Carpenter
@ 2021-08-03 16:25 ` Ewan Milne
2021-08-03 17:17 ` Himanshu Madhani
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Ewan Milne @ 2021-08-03 16:25 UTC (permalink / raw)
To: Dan Carpenter
Cc: Nilesh Javali, GR-QLogic-Storage-Upstream, James E.J. Bottomley,
Martin K. Petersen, Quinn Tran, Himanshu Madhani, Larry Wisneski,
linux-scsi, kernel-janitors
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
On Tue, Aug 3, 2021 at 11:57 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> The sp->free(sp); call frees "sp" and then the debug code dereferences
> it on the next line. Swap the order.
>
> Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/scsi/qla2xxx/qla_bsg.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
> index 0739f8ad525a..4b5d28d89d69 100644
> --- a/drivers/scsi/qla2xxx/qla_bsg.c
> +++ b/drivers/scsi/qla2xxx/qla_bsg.c
> @@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res)
> struct bsg_job *bsg_job = sp->u.bsg_job;
> struct fc_bsg_reply *bsg_reply = bsg_job->reply;
>
> - sp->free(sp);
> -
> ql_dbg(ql_dbg_user, sp->vha, 0x7009,
> "%s: sp hdl %x, result=%x bsg ptr %p\n",
> __func__, sp->handle, res, bsg_job);
>
> + sp->free(sp);
> +
> bsg_reply->result = res;
> bsg_job_done(bsg_job, bsg_reply->result,
> bsg_reply->reply_payload_rcv_len);
> --
> 2.20.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] scsi: qla2xxx: Fix use after free in debug code
2021-08-03 15:56 [PATCH] scsi: qla2xxx: Fix use after free in debug code Dan Carpenter
2021-08-03 16:25 ` Ewan Milne
@ 2021-08-03 17:17 ` Himanshu Madhani
2021-08-06 3:12 ` Martin K. Petersen
2021-08-10 5:20 ` Martin K. Petersen
3 siblings, 0 replies; 5+ messages in thread
From: Himanshu Madhani @ 2021-08-03 17:17 UTC (permalink / raw)
To: Dan Carpenter
Cc: Nilesh Javali, GR-QLogic-Storage-Upstream, James E.J. Bottomley,
Martin Petersen, Quinn Tran, Larry Wisneski, linux-scsi,
kernel-janitors@vger.kernel.org
> On Aug 3, 2021, at 10:56 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> The sp->free(sp); call frees "sp" and then the debug code dereferences
> it on the next line. Swap the order.
>
> Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/scsi/qla2xxx/qla_bsg.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
> index 0739f8ad525a..4b5d28d89d69 100644
> --- a/drivers/scsi/qla2xxx/qla_bsg.c
> +++ b/drivers/scsi/qla2xxx/qla_bsg.c
> @@ -25,12 +25,12 @@ void qla2x00_bsg_job_done(srb_t *sp, int res)
> struct bsg_job *bsg_job = sp->u.bsg_job;
> struct fc_bsg_reply *bsg_reply = bsg_job->reply;
>
> - sp->free(sp);
> -
> ql_dbg(ql_dbg_user, sp->vha, 0x7009,
> "%s: sp hdl %x, result=%x bsg ptr %p\n",
> __func__, sp->handle, res, bsg_job);
>
> + sp->free(sp);
> +
> bsg_reply->result = res;
> bsg_job_done(bsg_job, bsg_reply->result,
> bsg_reply->reply_payload_rcv_len);
> --
> 2.20.1
>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
--
Himanshu Madhani Oracle Linux Engineering
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] scsi: qla2xxx: Fix use after free in debug code
2021-08-03 15:56 [PATCH] scsi: qla2xxx: Fix use after free in debug code Dan Carpenter
2021-08-03 16:25 ` Ewan Milne
2021-08-03 17:17 ` Himanshu Madhani
@ 2021-08-06 3:12 ` Martin K. Petersen
2021-08-10 5:20 ` Martin K. Petersen
3 siblings, 0 replies; 5+ messages in thread
From: Martin K. Petersen @ 2021-08-06 3:12 UTC (permalink / raw)
To: Dan Carpenter
Cc: Nilesh Javali, GR-QLogic-Storage-Upstream, James E.J. Bottomley,
Martin K. Petersen, Quinn Tran, Himanshu Madhani, Larry Wisneski,
linux-scsi, kernel-janitors
Dan,
> The sp->free(sp); call frees "sp" and then the debug code dereferences
> it on the next line. Swap the order.
Applied to 5.15/scsi-staging, thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] scsi: qla2xxx: Fix use after free in debug code
2021-08-03 15:56 [PATCH] scsi: qla2xxx: Fix use after free in debug code Dan Carpenter
` (2 preceding siblings ...)
2021-08-06 3:12 ` Martin K. Petersen
@ 2021-08-10 5:20 ` Martin K. Petersen
3 siblings, 0 replies; 5+ messages in thread
From: Martin K. Petersen @ 2021-08-10 5:20 UTC (permalink / raw)
To: Dan Carpenter, Nilesh Javali
Cc: Martin K . Petersen, linux-scsi, Himanshu Madhani,
GR-QLogic-Storage-Upstream, Larry Wisneski, James E.J. Bottomley,
kernel-janitors, Quinn Tran
On Tue, 3 Aug 2021 18:56:25 +0300, Dan Carpenter wrote:
> The sp->free(sp); call frees "sp" and then the debug code dereferences
> it on the next line. Swap the order.
>
>
>
>
Applied to 5.15/scsi-queue, thanks!
[1/1] scsi: qla2xxx: Fix use after free in debug code
https://git.kernel.org/mkp/scsi/c/e3d2612f583b
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 5+ messages in thread