From: Ranjan Kumar <ranjan.kumar@broadcom.com>
To: linux-scsi@vger.kernel.org, martin.petersen@oracle.com
Cc: sathya.prakash@broadcom.com, chandrakanth.patil@broadcom.com,
sweeti.vandure@broadcom.com, vishakhavc@google.com,
ipylypiv@google.com, Ranjan Kumar <ranjan.kumar@broadcom.com>,
Sashiko <sashiko-bot@kernel.org>
Subject: [PATCH 14/21] scsi: mpi3mr: Fix target private data use after free in BSG passthrough
Date: Wed, 4 Nov 2026 17:30:55 +0530 [thread overview]
Message-ID: <20261104120103.503871-15-ranjan.kumar@broadcom.com> (raw)
In-Reply-To: <20261104120103.503871-1-ranjan.kumar@broadcom.com>
A BSG task management request raises block_io on the SCSI target private
data and lowers it after the command completes. The pointer is read
without a lock and the target device reference is dropped before the
wait. If the device is removed meanwhile, the private data is freed and
block_io is decremented in freed memory.
Do the lookup and the update under the target device lock, free the
private data under the same lock, and keep the target device reference
until the count is released.
Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260818231426.58105-1-chandrakanth.patil@broadcom.com?part=3
Closes: https://sashiko.dev/#/patchset/20260818231426.58105-1-chandrakanth.patil@broadcom.com?part=4
Closes: https://sashiko.dev/#/patchset/20260825210411.301535-1-chandrakanth.patil@broadcom.com?part=1
Closes: https://sashiko.dev/#/patchset/20260825210411.301535-1-chandrakanth.patil@broadcom.com?part=3
Closes: https://sashiko.dev/#/patchset/20260825210411.301535-1-chandrakanth.patil@broadcom.com?part=4
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
---
drivers/scsi/mpi3mr/mpi3mr.h | 5 +++
drivers/scsi/mpi3mr/mpi3mr_app.c | 24 +++++++-------
drivers/scsi/mpi3mr/mpi3mr_os.c | 55 ++++++++++++++++++++++++++++++--
3 files changed, 69 insertions(+), 15 deletions(-)
diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h
index d6e16707fd97..da47100d895e 100644
--- a/drivers/scsi/mpi3mr/mpi3mr.h
+++ b/drivers/scsi/mpi3mr/mpi3mr.h
@@ -1533,6 +1533,11 @@ int mpi3mr_issue_tm(struct mpi3mr_ioc *mrioc, u8 tm_type,
u16 handle, uint lun, u16 htag, ulong timeout,
struct mpi3mr_drv_cmd *drv_cmd,
u8 *resp_code, struct scsi_cmnd *scmd);
+struct mpi3mr_stgt_priv_data *mpi3mr_tgtdev_block_io_inc(struct mpi3mr_ioc *mrioc,
+ struct mpi3mr_tgt_dev *tgtdev);
+void mpi3mr_tgtdev_block_io_dec(struct mpi3mr_ioc *mrioc,
+ struct mpi3mr_tgt_dev *tgtdev,
+ struct mpi3mr_stgt_priv_data *stgt_priv);
struct mpi3mr_tgt_dev *mpi3mr_get_tgtdev_by_handle(
struct mpi3mr_ioc *mrioc, u16 handle);
void mpi3mr_pel_get_seqnum_complete(struct mpi3mr_ioc *mrioc,
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
index db27bff58c27..4df0dc81358b 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -2439,7 +2439,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
struct mpi3_scsi_task_mgmt_request *tm_req;
u32 erbsz = MPI3MR_SENSE_BUF_SZ, tmplen;
u16 dev_handle;
- struct mpi3mr_tgt_dev *tgtdev;
+ struct mpi3mr_tgt_dev *tgtdev = NULL;
struct mpi3mr_stgt_priv_data *stgt_priv = NULL;
struct mpi3mr_bsg_in_reply_buf *bsg_reply_buf = NULL;
u32 din_size = 0, dout_size = 0;
@@ -2791,14 +2791,8 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
}
if (block_io) {
tgtdev = mpi3mr_get_tgtdev_by_handle(mrioc, dev_handle);
- if (tgtdev) {
- if (tgtdev->starget && tgtdev->starget->hostdata) {
- stgt_priv = (struct mpi3mr_stgt_priv_data *)
- tgtdev->starget->hostdata;
- atomic_inc(&stgt_priv->block_io);
- }
- mpi3mr_tgtdev_put(tgtdev);
- }
+ if (tgtdev)
+ stgt_priv = mpi3mr_tgtdev_block_io_inc(mrioc, tgtdev);
}
mrioc->bsg_cmds.state = MPI3MR_CMD_PENDING;
@@ -2830,14 +2824,18 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
dprint_bsg_err(mrioc,
"%s: posting bsg request is failed\n", __func__);
rval = -EAGAIN;
- if (block_io && stgt_priv)
- atomic_dec(&stgt_priv->block_io);
+ if (tgtdev) {
+ mpi3mr_tgtdev_block_io_dec(mrioc, tgtdev, stgt_priv);
+ mpi3mr_tgtdev_put(tgtdev);
+ }
goto out_unlock;
}
wait_for_completion_timeout(&mrioc->bsg_cmds.done,
(karg->timeout * HZ));
- if (block_io && stgt_priv)
- atomic_dec(&stgt_priv->block_io);
+ if (tgtdev) {
+ mpi3mr_tgtdev_block_io_dec(mrioc, tgtdev, stgt_priv);
+ mpi3mr_tgtdev_put(tgtdev);
+ }
if (!(mrioc->bsg_cmds.state & MPI3MR_CMD_COMPLETE)) {
timed_out = true;
mrioc->bsg_cmds.is_waiting = 0;
diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
index 99928fcc5bd7..e7833b24c509 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
@@ -788,6 +788,58 @@ struct mpi3mr_tgt_dev *mpi3mr_get_tgtdev_by_handle(
return tgtdev;
}
+/**
+ * mpi3mr_tgtdev_block_io_inc - Block I/O on the SCSI target of a tgtdev
+ * @mrioc: Adapter instance reference
+ * @tgtdev: Target device reference, held by the caller
+ *
+ * Increment block_io of the SCSI target private data. The lookup and the
+ * increment are done under tgtdev_lock, which mpi3mr_target_destroy holds
+ * while it frees the private data.
+ *
+ * Return: The private data that was incremented, only to be handed back to
+ * mpi3mr_tgtdev_block_io_dec. NULL if the tgtdev has no SCSI target.
+ */
+struct mpi3mr_stgt_priv_data *mpi3mr_tgtdev_block_io_inc(struct mpi3mr_ioc *mrioc,
+ struct mpi3mr_tgt_dev *tgtdev)
+{
+ struct mpi3mr_stgt_priv_data *stgt_priv = NULL;
+ unsigned long flags;
+
+ spin_lock_irqsave(&mrioc->tgtdev_lock, flags);
+ if (tgtdev->starget && tgtdev->starget->hostdata) {
+ stgt_priv = tgtdev->starget->hostdata;
+ atomic_inc(&stgt_priv->block_io);
+ }
+ spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
+ return stgt_priv;
+}
+
+/**
+ * mpi3mr_tgtdev_block_io_dec - Undo mpi3mr_tgtdev_block_io_inc
+ * @mrioc: Adapter instance reference
+ * @tgtdev: Target device reference, held by the caller
+ * @stgt_priv: Value returned by mpi3mr_tgtdev_block_io_inc
+ *
+ * Decrement block_io only if the SCSI target still has the same private
+ * data. If the target was removed meanwhile the private data is gone
+ * and there is nothing to undo.
+ */
+void mpi3mr_tgtdev_block_io_dec(struct mpi3mr_ioc *mrioc,
+ struct mpi3mr_tgt_dev *tgtdev,
+ struct mpi3mr_stgt_priv_data *stgt_priv)
+{
+ unsigned long flags;
+
+ if (!stgt_priv)
+ return;
+
+ spin_lock_irqsave(&mrioc->tgtdev_lock, flags);
+ if (tgtdev->starget && tgtdev->starget->hostdata == stgt_priv)
+ atomic_dec_if_positive(&stgt_priv->block_io);
+ spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
+}
+
/**
* __mpi3mr_get_tgtdev_by_perst_id -Get tgtdev from persist ID
* @mrioc: Adapter instance reference
@@ -4953,10 +5005,9 @@ static void mpi3mr_target_destroy(struct scsi_target *starget)
mpi3mr_tgtdev_put(tgt_dev);
mpi3mr_tgtdev_put(tgt_dev);
}
- spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
-
kfree(starget->hostdata);
starget->hostdata = NULL;
+ spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
}
/**
--
2.47.3
next prev parent reply other threads:[~2026-11-04 12:10 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-04 12:00 [PATCH 00/21] scsi: mpi3mr: Fix issues reported by Sashiko Ranjan Kumar
2026-11-04 12:00 ` [PATCH 01/21] scsi: mpi3mr: Fix out-of-bounds read of the BSG request Ranjan Kumar
2026-11-04 12:00 ` [PATCH 02/21] scsi: mpi3mr: Fix integer wrap in BSG buffer entry lengths Ranjan Kumar
2026-11-04 12:00 ` [PATCH 03/21] scsi: mpi3mr: Remove redundant BSG buffer length checks Ranjan Kumar
2026-11-04 12:00 ` [PATCH 04/21] scsi: mpi3mr: Fix PRP list leak in BSG passthrough Ranjan Kumar
2026-11-04 12:00 ` [PATCH 05/21] scsi: mpi3mr: Fix reposting of invalid reply address on the admin queue Ranjan Kumar
2026-11-04 12:00 ` [PATCH 06/21] scsi: mpi3mr: Fix endianness of device handles in BSG requests Ranjan Kumar
2026-11-04 12:00 ` [PATCH 07/21] scsi: mpi3mr: Fix integer overflow in the HDB upload bounds check Ranjan Kumar
2026-11-04 12:00 ` [PATCH 08/21] scsi: mpi3mr: Fix integer overflow in the log data size calculation Ranjan Kumar
2026-11-04 12:00 ` [PATCH 09/21] scsi: mpi3mr: Queue DEVICE_INFO_CHANGED events to the bottom half again Ranjan Kumar
2026-11-04 12:00 ` [PATCH 10/21] scsi: mpi3mr: Fix target device reference leaks Ranjan Kumar
2026-11-04 12:00 ` [PATCH 11/21] scsi: mpi3mr: Fix the 32 bit shift when building the phy mask Ranjan Kumar
2026-11-04 12:00 ` [PATCH 12/21] scsi: mpi3mr: Fix empty device list race in the all targets query Ranjan Kumar
2026-11-04 12:00 ` [PATCH 13/21] scsi: mpi3mr: Fix the lowest phy number for phys 32 and above Ranjan Kumar
2026-11-04 12:00 ` Ranjan Kumar [this message]
2026-11-04 12:28 ` [PATCH 14/21] scsi: mpi3mr: Fix target private data use after free in BSG passthrough sashiko-bot
2026-11-04 12:00 ` [PATCH 15/21] scsi: mpi3mr: Fix block_io accounting when a target is re-created during BSG Ranjan Kumar
2026-11-04 12:28 ` sashiko-bot
2026-11-04 12:00 ` [PATCH 16/21] scsi: mpi3mr: Fix sense buffer use after free on BSG command completion Ranjan Kumar
2026-11-04 12:26 ` sashiko-bot
2026-11-04 12:00 ` [PATCH 17/21] scsi: mpi3mr: Reject a too small reply size when enabling log data Ranjan Kumar
2026-11-04 12:00 ` [PATCH 18/21] scsi: mpi3mr: Fix partly written and lost entries in the log data buffer Ranjan Kumar
2026-11-04 12:01 ` [PATCH 19/21] scsi: mpi3mr: Fix byte order handling in the NVMe passthrough commands Ranjan Kumar
2026-11-04 12:01 ` [PATCH 20/21] scsi: mpi3mr: Fix byte order of the BSG status reply Ranjan Kumar
2026-11-04 12:01 ` [PATCH 21/21] scsi: mpi3mr: Use the correct conversion for the diag buffer post request Ranjan Kumar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261104120103.503871-15-ranjan.kumar@broadcom.com \
--to=ranjan.kumar@broadcom.com \
--cc=chandrakanth.patil@broadcom.com \
--cc=ipylypiv@google.com \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=sashiko-bot@kernel.org \
--cc=sathya.prakash@broadcom.com \
--cc=sweeti.vandure@broadcom.com \
--cc=vishakhavc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox