| Message ID | 20200729231011.13240-1-emilne@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | scsi: lpfc: nvmet: avoid hang / use-after-free again when destroying targetport | expand |
On 7/29/2020 4:10 PM, Ewan D. Milne wrote: > We cannot wait on a completion object in the lpfc_nvme_targetport structure > in the _destroy_targetport() code path because the NVMe/fc transport will > free that structure immediately after the .targetport_delete() callback. > This results in a use-after-free, and a crash if slub_debug=FZPU is enabled. > > An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8 > ("scsi: lpfc: Correct localport timeout duration error") subsequently changed > the code to reference the completion through a pointer in the object rather > than the local stack variable. Fix this by using the stack variable directly. > > Fixes: 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error") > Signed-off-by: Ewan D. Milne <emilne@redhat.com> > --- > Thanks Ewan Reviewed-by: James Smart <james.smart@broadcom.com> -- james
On Wed, 29 Jul 2020 19:10:11 -0400, Ewan D. Milne wrote: > We cannot wait on a completion object in the lpfc_nvme_targetport structure > in the _destroy_targetport() code path because the NVMe/fc transport will > free that structure immediately after the .targetport_delete() callback. > This results in a use-after-free, and a crash if slub_debug=FZPU is enabled. > > An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8 > ("scsi: lpfc: Correct localport timeout duration error") subsequently changed > the code to reference the completion through a pointer in the object rather > than the local stack variable. Fix this by using the stack variable directly. Applied to 5.9/scsi-queue, thanks! [1/1] scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport https://git.kernel.org/mkp/scsi/c/af6de8c60fe9
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c index 88760416a8cb..fcd9d4c2f1ee 100644 --- a/drivers/scsi/lpfc/lpfc_nvmet.c +++ b/drivers/scsi/lpfc/lpfc_nvmet.c @@ -2112,7 +2112,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) } tgtp->tport_unreg_cmp = &tport_unreg_cmp; nvmet_fc_unregister_targetport(phba->targetport); - if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp, + if (!wait_for_completion_timeout(&tport_unreg_cmp, msecs_to_jiffies(LPFC_NVMET_WAIT_TMO))) lpfc_printf_log(phba, KERN_ERR, LOG_NVME, "6179 Unreg targetport x%px timeout "
We cannot wait on a completion object in the lpfc_nvme_targetport structure in the _destroy_targetport() code path because the NVMe/fc transport will free that structure immediately after the .targetport_delete() callback. This results in a use-after-free, and a crash if slub_debug=FZPU is enabled. An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error") subsequently changed the code to reference the completion through a pointer in the object rather than the local stack variable. Fix this by using the stack variable directly. Fixes: 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error") Signed-off-by: Ewan D. Milne <emilne@redhat.com> --- drivers/scsi/lpfc/lpfc_nvmet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)