Commit 5ecc5ea6 authored by Daniel Wagner's avatar Daniel Wagner Committed by Greg Kroah-Hartman
Browse files

scsi: qla2xxx: Warn if done() or free() are called on an already freed srb

[ Upstream commit c0014f94 ]

Emit a warning when ->done or ->free are called on an already freed
srb. There is a hidden use-after-free bug in the driver which corrupts
the srb memory pool which originates from the cleanup callbacks.

An extensive search didn't bring any lights on the real problem. The
initial fix was to set both pointers to NULL and try to catch invalid
accesses. But instead the memory corruption was gone and the driver
didn't crash. Since not all calling places check for NULL pointer, add
explicitly default handlers. With this we workaround the memory
corruption and add a debug help.

Link: https://lore.kernel.org/r/20200908081516.8561-2-dwagner@suse.de


Reviewed-by: default avatarMartin Wilck <mwilck@suse.com>
Reviewed-by: default avatarArun Easi <aeasi@marvell.com>
Signed-off-by: default avatarDaniel Wagner <dwagner@suse.de>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent d6447b66
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment