From patchwork Tue Mar 5 10:58:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Saurav Kashyap X-Patchwork-Id: 10839287 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 644691823 for ; Tue, 5 Mar 2019 10:59:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 515B92B2A9 for ; Tue, 5 Mar 2019 10:59:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 45EA62B352; Tue, 5 Mar 2019 10:59:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E13772B2A9 for ; Tue, 5 Mar 2019 10:59:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727477AbfCEK7t (ORCPT ); Tue, 5 Mar 2019 05:59:49 -0500 Received: from mail-eopbgr790048.outbound.protection.outlook.com ([40.107.79.48]:52770 "EHLO NAM03-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726150AbfCEK7t (ORCPT ); Tue, 5 Mar 2019 05:59:49 -0500 Received: from BYAPR07CA0009.namprd07.prod.outlook.com (2603:10b6:a02:bc::22) by DM5PR07MB3003.namprd07.prod.outlook.com (2603:10b6:3:e3::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1665.18; Tue, 5 Mar 2019 10:59:46 +0000 Received: from BY2NAM05FT041.eop-nam05.prod.protection.outlook.com (2a01:111:f400:7e52::201) by BYAPR07CA0009.outlook.office365.com (2603:10b6:a02:bc::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1686.16 via Frontend Transport; Tue, 5 Mar 2019 10:59:46 +0000 Authentication-Results: spf=fail (sender IP is 199.233.58.38) smtp.mailfrom=marvell.com; vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=fail action=none header.from=marvell.com; Received-SPF: Fail (protection.outlook.com: domain of marvell.com does not designate 199.233.58.38 as permitted sender) receiver=protection.outlook.com; client-ip=199.233.58.38; helo=CAEXCH02.caveonetworks.com; Received: from CAEXCH02.caveonetworks.com (199.233.58.38) by BY2NAM05FT041.mail.protection.outlook.com (10.152.100.178) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) id 15.20.1686.5 via Frontend Transport; Tue, 5 Mar 2019 10:59:46 +0000 Received: from dut1171.mv.qlogic.com (10.112.88.18) by CAEXCH02.caveonetworks.com (10.67.98.110) with Microsoft SMTP Server (TLS) id 14.2.347.0; Tue, 5 Mar 2019 02:59:43 -0800 Received: from dut1171.mv.qlogic.com (localhost [127.0.0.1]) by dut1171.mv.qlogic.com (8.14.7/8.14.7) with ESMTP id x25AxgQv013284; Tue, 5 Mar 2019 02:59:42 -0800 Received: (from root@localhost) by dut1171.mv.qlogic.com (8.14.7/8.14.7/Submit) id x25AxgtV013283; Tue, 5 Mar 2019 02:59:42 -0800 From: Saurav Kashyap To: CC: , Subject: [PATCH 14/26] qedf: Add additional checks for io_req->sc_cmd validity. Date: Tue, 5 Mar 2019 02:58:49 -0800 Message-ID: <20190305105901.13185-15-skashyap@marvell.com> X-Mailer: git-send-email 2.12.0 In-Reply-To: <20190305105901.13185-1-skashyap@marvell.com> References: <20190305105901.13185-1-skashyap@marvell.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-Matching-Connectors: 131962571863333011;(abac79dc-c90b-41ba-8033-08d666125e47);(abac79dc-c90b-41ba-8033-08d666125e47) X-Forefront-Antispam-Report: CIP:199.233.58.38;IPV:CAL;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10009020)(136003)(346002)(396003)(376002)(39860400002)(2980300002)(1110001)(1109001)(339900001)(199004)(189003)(47776003)(305945005)(86362001)(26826003)(53936002)(4326008)(6862004)(2906002)(81156014)(50226002)(81166006)(8676002)(356004)(5660300002)(498600001)(8936002)(87636003)(54906003)(1076003)(48376002)(50466002)(68736007)(80596001)(69596002)(446003)(2616005)(51416003)(76176011)(336012)(2351001)(85426001)(36756003)(16586007)(36906005)(316002)(476003)(126002)(105606002)(11346002)(106466001)(486006)(97736004)(26005)(42186006);DIR:OUT;SFP:1101;SCL:1;SRVR:DM5PR07MB3003;H:CAEXCH02.caveonetworks.com;FPR:;SPF:Fail;LANG:en;PTR:InfoDomainNonexistent;A:1;MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ffd7dd3d-acc2-45c0-210f-08d6a159adfd X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(5600127)(711020)(4605104)(2017052603328);SRVR:DM5PR07MB3003; X-MS-TrafficTypeDiagnostic: DM5PR07MB3003: X-Microsoft-Antispam-PRVS: X-Forefront-PRVS: 0967749BC1 X-Microsoft-Exchange-Diagnostics: 1;DM5PR07MB3003;23:jvoy+86EE0ngEGcmfnnr8TN9YqB8Q86hZI8ziSYQUQDo1yuJOmEniRbsOChjSJOny/lpdA81Tr/5vLn6KHcwEWUxmHw9tH2nDgalx17E8ySSVfRM62NVV/MobUeEjnWSQiZe7hvDgnjwzO98xLJwo4oIZCON+NkCA53jg/R3eJV6EVMtXlqiDYN7F8A0QNr3/zSIgErVECHlmN+Q6f7o2N9ADlLGYF5HWcikTh1HuUdc2t4xOWWVc/ch9iWbZaP/JTNEEmXcv+cTZ9lu4PKBU08u5O0VJyvhlkDw7mfA/rw3q4zzPlbeNXNogTgjbQP3RbOr3TH9V7z2NjrwWpLHtEvznmXZfBC8N1fs0gIccDX8pFCZyPlJBfBRKSIue5FnWWwen5qeeqeAiTGzjIvJGp2wR77gXilyKTGa/TkYfDcnYKZmwnSdcMfWwDKyMw7GxWwNGvmCyW1ZmMIrSK2vA1oH99cqUK+f1F18U8kpGpJ4NOayiEBracXIe+p1GtbWOIT6hhhN6Fi5xZ8+Hu98I20Y8hNl0aGFUXkwsddsLdNHUbt+ptfNXHnjN173H7G9bsKIjaPcYSQuBxLN5VAiysa71SCnYVsE0HtjQie0U24mwHrluu0GpUB9doZDXT+ySKezjFGo4qAaGc5mUb7QukA7M4/YPTtozEM6LPmsaweporDiJJfyvtA96PNlC27E5769wqyVnAmRLkPt8p5JVZsQVxPuv9Y5JVHKeISp2YIuLDvGC74UNadYBa+HvhYeYORimuo8dA3MRXdoEfaaJq6SrKQtSMcbZc4Z1JlaZF0rxPbJrh/hP8Zwmar3Zuokrq8BjgDtVnkCv1bG6CZkMYlmDaLrzAdsLyuZ07pT5LbyXhZe5WANjsrgBS5AIrfWd5zgskHsmv1ngj09GgWLoM5vD0f9cJdH7vkEortn/OBJUOPlMtIHlMsJQEsbJpeJrHMyTk+j/R+rhYJKlXscK3qgWPJjAzHR3HQ2YPbohtgSAUnS8hiiLyJhR9/frMFinOo7XbZJLJIHGFel+rUvrxMyLarsFgbl4GLSjek9P5wF/0xNqhYXdpGw4iLPuLX9h3SoV9x4XNHT1FPa7Tq/BUJAim72DBQtAQRd1jjtiag40iedG7QqJOzqff3eL2wmETtf1It9z1Lx5spxGToaZxOxUVvjK95mVFJRwE1UAssmTwxGNGVTmb5Vr3S0yEHueVe5kbdofp4hE0Qn6pdoTA== X-Microsoft-Antispam-Message-Info: 2/6n+d7bJUKBa739EU+LEvqXXh+J9s9cCjsmDhLY4bR6Ff5BmSy3lTG41MYDS3JrXGECrrRZIXDmGyKC/8cTOHj7lZjoHn2tfivg6zz+jkyqWuBCYv7cIXbTdrKFWVtlurXBeADvdqk474H/lxsQBqPDRQP6HT+3mLGZ+2FN3yBEviISVnTpSCZIW44rch8ec7Q4/qrhDJaO1P1XwvkDXT0v/41gpGq1/AEsDBkBYI0Z3F88nEn4DJEaAn/oIelrtW6MqSQgvzciwwK5rsAf7+lXLY372UrI5+s3G4q4XJOtjz/sLs/Uuj+41t8S0LCHGAt4/IlMHkV3niTU8UlA9CULgiYdyB+iIo3XQYE3NNOC5DkIRhQBsa+hhNzZ1p2HjNR690bNEYwO7Dpq1AnHCv2TyNV9hrJ8hISDnn4uk08= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Mar 2019 10:59:46.0180 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ffd7dd3d-acc2-45c0-210f-08d6a159adfd X-MS-Exchange-CrossTenant-Id: 5afe0b00-7697-4969-b663-5eab37d5f47e X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5afe0b00-7697-4969-b663-5eab37d5f47e;Ip=[199.233.58.38];Helo=[CAEXCH02.caveonetworks.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR07MB3003 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Chad Dupuis - Check the validity of various pointers before processing. Signed-off-by: Chad Dupuis Signed-off-by: Saurav Kashyap --- drivers/scsi/qedf/qedf_io.c | 39 +++++++++++++++++++++++++++++++++++++-- 1 file changed, 37 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c index f04191f..f501a37 100644 --- a/drivers/scsi/qedf/qedf_io.c +++ b/drivers/scsi/qedf/qedf_io.c @@ -1324,7 +1324,7 @@ void qedf_scsi_done(struct qedf_ctx *qedf, struct qedf_ioreq *io_req, if (!virt_addr_valid(sc_cmd)) { QEDF_ERR(&qedf->dbg_ctx, "sc_cmd=%p is not valid.", sc_cmd); - return; + goto bad_scsi_ptr; } if (!sc_cmd->SCp.ptr) { @@ -1336,7 +1336,34 @@ void qedf_scsi_done(struct qedf_ctx *qedf, struct qedf_ioreq *io_req, if (!sc_cmd->device) { QEDF_ERR(&qedf->dbg_ctx, "Device for sc_cmd %p is NULL.\n", sc_cmd); - return; + goto bad_scsi_ptr; + } + + if (!virt_addr_valid(sc_cmd->device)) { + QEDF_ERR(&qedf->dbg_ctx, + "Device pointer for sc_cmd %p is bad.\n", sc_cmd); + goto bad_scsi_ptr; + } + + if (!sc_cmd->sense_buffer) { + QEDF_ERR(&qedf->dbg_ctx, + "sc_cmd->sense_buffer for sc_cmd %p is NULL.\n", + sc_cmd); + goto bad_scsi_ptr; + } + + if (!virt_addr_valid(sc_cmd->sense_buffer)) { + QEDF_ERR(&qedf->dbg_ctx, + "sc_cmd->sense_buffer for sc_cmd %p is bad.\n", + sc_cmd); + goto bad_scsi_ptr; + } + + if (!sc_cmd->scsi_done) { + QEDF_ERR(&qedf->dbg_ctx, + "sc_cmd->scsi_done for sc_cmd %p is NULL.\n", + sc_cmd); + goto bad_scsi_ptr; } qedf_unmap_sg_list(qedf, io_req); @@ -1365,6 +1392,14 @@ void qedf_scsi_done(struct qedf_ctx *qedf, struct qedf_ioreq *io_req, sc_cmd->SCp.ptr = NULL; sc_cmd->scsi_done(sc_cmd); kref_put(&io_req->refcount, qedf_release_cmd); + +bad_scsi_ptr: + /* + * Clear the io_req->sc_cmd backpointer so we don't try to process + * this again + */ + io_req->sc_cmd = NULL; + kref_put(&io_req->refcount, qedf_release_cmd); /* ID: 001 */ } /*