From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS,T_DKIMWL_WL_HIGH,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2B16C468BD for ; Sat, 8 Jun 2019 11:51:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8CA3F21537 for ; Sat, 8 Jun 2019 11:51:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1559994670; bh=HlRPGL34TlAn9v95aef3KCyfQS5shKTa1sZg8gTTbrc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=gXwWeEgKO7gmTUSoz3LyVjOsGse5+VejPutVSoGfzXP0rpL/KCdIPFPTA6Uk9tNwe uaPdnZy5tZJ7+b84GfvuAQk3BV3NqnZVsn1gvnsVWlNsRIvDGMF3U7e8s0NVOmXQ// dHb1IhEtoO9qdA/gIXTs9bhA27CAPV7EGimy/U3k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727914AbfFHLrz (ORCPT ); Sat, 8 Jun 2019 07:47:55 -0400 Received: from mail.kernel.org ([198.145.29.99]:36620 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729434AbfFHLrw (ORCPT ); Sat, 8 Jun 2019 07:47:52 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9C2C721537; Sat, 8 Jun 2019 11:47:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1559994471; bh=HlRPGL34TlAn9v95aef3KCyfQS5shKTa1sZg8gTTbrc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kInmS+Qd+smbYg7KrGK4e6iS/eHAD9jyil7V22kNynr7GIh4sPFZB9AsQeh3ioHT6 wdC9dAcMnGzMVetM9KLCU9JHCav6Fjtq4UY88+IdI+yCccAsQLRsxhgA01rtJAnTeb Trsnk1axFgoHFwc7big4Tj8HX3fVLJvSr/U88Ul8= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: YueHaibing , Hulk Robot , Bart Van Assche , "Martin K . Petersen" , Sasha Levin , linux-scsi@vger.kernel.org Subject: [PATCH AUTOSEL 4.14 29/31] scsi: scsi_dh_alua: Fix possible null-ptr-deref Date: Sat, 8 Jun 2019 07:46:40 -0400 Message-Id: <20190608114646.9415-29-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190608114646.9415-1-sashal@kernel.org> References: <20190608114646.9415-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: YueHaibing [ Upstream commit 12e750bc62044de096ab9a95201213fd912b9994 ] If alloc_workqueue fails in alua_init, it should return -ENOMEM, otherwise it will trigger null-ptr-deref while unloading module which calls destroy_workqueue dereference wq->lock like this: BUG: KASAN: null-ptr-deref in __lock_acquire+0x6b4/0x1ee0 Read of size 8 at addr 0000000000000080 by task syz-executor.0/7045 CPU: 0 PID: 7045 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 Call Trace: dump_stack+0xa9/0x10e __kasan_report+0x171/0x18d ? __lock_acquire+0x6b4/0x1ee0 kasan_report+0xe/0x20 __lock_acquire+0x6b4/0x1ee0 lock_acquire+0xb4/0x1b0 __mutex_lock+0xd8/0xb90 drain_workqueue+0x25/0x290 destroy_workqueue+0x1f/0x3f0 __x64_sys_delete_module+0x244/0x330 do_syscall_64+0x72/0x2a0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Reported-by: Hulk Robot Fixes: 03197b61c5ec ("scsi_dh_alua: Use workqueue for RTPG") Signed-off-by: YueHaibing Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c index 0962fd544401..09c6a16fab93 100644 --- a/drivers/scsi/device_handler/scsi_dh_alua.c +++ b/drivers/scsi/device_handler/scsi_dh_alua.c @@ -1151,10 +1151,8 @@ static int __init alua_init(void) int r; kaluad_wq = alloc_workqueue("kaluad", WQ_MEM_RECLAIM, 0); - if (!kaluad_wq) { - /* Temporary failure, bypass */ - return SCSI_DH_DEV_TEMP_BUSY; - } + if (!kaluad_wq) + return -ENOMEM; r = scsi_register_device_handler(&alua_dh); if (r != 0) { -- 2.20.1