* [PATCH] scsi: target: pscsi: fix bio_put for error case
@ 2024-02-14 14:43 Naohiro Aota
2024-02-15 5:24 ` Christoph Hellwig
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Naohiro Aota @ 2024-02-14 14:43 UTC (permalink / raw)
To: linux-scsi, target-devel; +Cc: martin.petersen, Naohiro Aota
As of commit 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc
wrapper"), a bio allocated by bio_kmalloc() must be freed by bio_uninit()
and kfree(). That is not done properly for the error case, hitting WARN and
NULL pointer dereference in bio_free().
Fixes: 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc wrapper")
CC: stable@vger.kernel.org # 6.1+
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
---
drivers/target/target_core_pscsi.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 41b7489d37ce..ed4fd22eac6e 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -907,12 +907,15 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
return 0;
fail:
- if (bio)
- bio_put(bio);
+ if (bio) {
+ bio_uninit(bio);
+ kfree(bio);
+ }
while (req->bio) {
bio = req->bio;
req->bio = bio->bi_next;
- bio_put(bio);
+ bio_uninit(bio);
+ kfree(bio);
}
req->biotail = NULL;
return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
--
2.43.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] scsi: target: pscsi: fix bio_put for error case
2024-02-14 14:43 [PATCH] scsi: target: pscsi: fix bio_put for error case Naohiro Aota
@ 2024-02-15 5:24 ` Christoph Hellwig
2024-02-15 11:33 ` Johannes Thumshirn
2024-02-15 20:39 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Christoph Hellwig @ 2024-02-15 5:24 UTC (permalink / raw)
To: Naohiro Aota; +Cc: linux-scsi, target-devel, martin.petersen
On Wed, Feb 14, 2024 at 11:43:56PM +0900, Naohiro Aota wrote:
> As of commit 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc
> wrapper"), a bio allocated by bio_kmalloc() must be freed by bio_uninit()
> and kfree(). That is not done properly for the error case, hitting WARN and
> NULL pointer dereference in bio_free().
>
> Fixes: 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc wrapper")
> CC: stable@vger.kernel.org # 6.1+
> Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] scsi: target: pscsi: fix bio_put for error case
2024-02-14 14:43 [PATCH] scsi: target: pscsi: fix bio_put for error case Naohiro Aota
2024-02-15 5:24 ` Christoph Hellwig
@ 2024-02-15 11:33 ` Johannes Thumshirn
2024-02-15 20:39 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Johannes Thumshirn @ 2024-02-15 11:33 UTC (permalink / raw)
To: Naohiro Aota, linux-scsi@vger.kernel.org,
target-devel@vger.kernel.org
Cc: martin.petersen@oracle.com
Looks good,
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] scsi: target: pscsi: fix bio_put for error case
2024-02-14 14:43 [PATCH] scsi: target: pscsi: fix bio_put for error case Naohiro Aota
2024-02-15 5:24 ` Christoph Hellwig
2024-02-15 11:33 ` Johannes Thumshirn
@ 2024-02-15 20:39 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2024-02-15 20:39 UTC (permalink / raw)
To: linux-scsi, target-devel, Naohiro Aota; +Cc: Martin K . Petersen
On Wed, 14 Feb 2024 23:43:56 +0900, Naohiro Aota wrote:
> As of commit 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc
> wrapper"), a bio allocated by bio_kmalloc() must be freed by bio_uninit()
> and kfree(). That is not done properly for the error case, hitting WARN and
> NULL pointer dereference in bio_free().
>
>
Applied to 6.8/scsi-fixes, thanks!
[1/1] scsi: target: pscsi: fix bio_put for error case
https://git.kernel.org/mkp/scsi/c/de959094eb21
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-02-15 20:39 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-02-14 14:43 [PATCH] scsi: target: pscsi: fix bio_put for error case Naohiro Aota
2024-02-15 5:24 ` Christoph Hellwig
2024-02-15 11:33 ` Johannes Thumshirn
2024-02-15 20:39 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox