diff mbox series

[2/2] scsi: ufs: set bsg_queue to NULL after remove

Message ID 20241217105840.120081-3-kanie@linux.alibaba.com (mailing list archive)
State Superseded
Headers show
Series fix some bsg related bugs | expand

Commit Message

Guixin Liu Dec. 17, 2024, 10:58 a.m. UTC 
Currently, this does not cause any issues, but I believe it is
necessary to set bsg_queue to NULL after removing it to prevent
potential use-after-free (UAF) access.

Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/ufs/core/ufs_bsg.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Avri Altman Dec. 17, 2024, 11:32 a.m. UTC | #1 
> 
> Currently, this does not cause any issues, but I believe it is necessary to set
> bsg_queue to NULL after removing it to prevent potential use-after-free (UAF)
> access.
OK.

> 
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>

> ---
>  drivers/ufs/core/ufs_bsg.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index
> 58023f735c19..8d4ad0a3f2cf 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -216,6 +216,7 @@ void ufs_bsg_remove(struct ufs_hba *hba)
>                 return;
> 
>         bsg_remove_queue(hba->bsg_queue);
> +       hba->bsg_queue = NULL;
> 
>         device_del(bsg_dev);
>         put_device(bsg_dev);
> --
> 2.43.0
diff mbox series

Patch

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 58023f735c19..8d4ad0a3f2cf 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -216,6 +216,7 @@  void ufs_bsg_remove(struct ufs_hba *hba)
 		return;
 
 	bsg_remove_queue(hba->bsg_queue);
+	hba->bsg_queue = NULL;
 
 	device_del(bsg_dev);
 	put_device(bsg_dev);