[PATCH v2 0/2] fix some bsg related bugs

[PATCH v2 0/2] fix some bsg related bugs

[Guixin Liu]

Changes from v1 to v2:
- Add fixes tag to the first patch.
- Add rb tag from Avri, thanks.

Guixin Liu (2):
  scsi: ufs: delete bsg_dev when setup bsg fail
  scsi: ufs: set bsg_queue to NULL after remove

 drivers/ufs/core/ufs_bsg.c | 2 ++
 1 file changed, 2 insertions(+)

-- 
2.43.0

[PATCH v2 1/2] scsi: ufs: delete bsg_dev when setup bsg fail

[Guixin Liu]

We should remove the bsg device when bsg_setup_queue() return fail
to release the resources.

Fixes: df032bf27a41 ("scsi: ufs: Add a bsg endpoint that supports UPIUs")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
---
 drivers/ufs/core/ufs_bsg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 6c09d97ae006..58023f735c19 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -257,6 +257,7 @@ int ufs_bsg_probe(struct ufs_hba *hba)
 			NULL, 0);
 	if (IS_ERR(q)) {
 		ret = PTR_ERR(q);
+		device_del(bsg_dev);
 		goto out;
 	}
 
-- 
2.43.0

[PATCH v2 2/2] scsi: ufs: set bsg_queue to NULL after remove

[Guixin Liu]

Currently, this does not cause any issues, but I believe it is
necessary to set bsg_queue to NULL after removing it to prevent
potential use-after-free (UAF) access.

Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
---
 drivers/ufs/core/ufs_bsg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 58023f735c19..8d4ad0a3f2cf 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -216,6 +216,7 @@ void ufs_bsg_remove(struct ufs_hba *hba)
 		return;
 
 	bsg_remove_queue(hba->bsg_queue);
+	hba->bsg_queue = NULL;
 
 	device_del(bsg_dev);
 	put_device(bsg_dev);
-- 
2.43.0

Re: [PATCH v2 0/2] fix some bsg related bugs

[Martin K. Petersen]

Guixin,

> Guixin Liu (2):
>   scsi: ufs: delete bsg_dev when setup bsg fail
>   scsi: ufs: set bsg_queue to NULL after remove

Applied to 6.14/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering