projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| a15a8890 SL |
1 | From 69c5cf352e44af886b99851724602b1e6a5af5db Mon Sep 17 00:00:00 2001 |
| 2 | From: YueHaibing <yuehaibing@huawei.com> | |
| 3 | Date: Mon, 27 May 2019 22:22:09 +0800 | |
| 4 | Subject: scsi: scsi_dh_alua: Fix possible null-ptr-deref | |
| 5 | ||
| 6 | [ Upstream commit 12e750bc62044de096ab9a95201213fd912b9994 ] | |
| 7 | ||
| 8 | If alloc_workqueue fails in alua_init, it should return -ENOMEM, otherwise | |
| 9 | it will trigger null-ptr-deref while unloading module which calls | |
| 10 | destroy_workqueue dereference | |
| 11 | wq->lock like this: | |
| 12 | ||
| 13 | BUG: KASAN: null-ptr-deref in __lock_acquire+0x6b4/0x1ee0 | |
| 14 | Read of size 8 at addr 0000000000000080 by task syz-executor.0/7045 | |
| 15 | ||
| 16 | CPU: 0 PID: 7045 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28 | |
| 17 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 | |
| 18 | Call Trace: | |
| 19 | dump_stack+0xa9/0x10e | |
| 20 | __kasan_report+0x171/0x18d | |
| 21 | ? __lock_acquire+0x6b4/0x1ee0 | |
| 22 | kasan_report+0xe/0x20 | |
| 23 | __lock_acquire+0x6b4/0x1ee0 | |
| 24 | lock_acquire+0xb4/0x1b0 | |
| 25 | __mutex_lock+0xd8/0xb90 | |
| 26 | drain_workqueue+0x25/0x290 | |
| 27 | destroy_workqueue+0x1f/0x3f0 | |
| 28 | __x64_sys_delete_module+0x244/0x330 | |
| 29 | do_syscall_64+0x72/0x2a0 | |
| 30 | entry_SYSCALL_64_after_hwframe+0x49/0xbe | |
| 31 | ||
| 32 | Reported-by: Hulk Robot <hulkci@huawei.com> | |
| 33 | Fixes: 03197b61c5ec ("scsi_dh_alua: Use workqueue for RTPG") | |
| 34 | Signed-off-by: YueHaibing <yuehaibing@huawei.com> | |
| 35 | Reviewed-by: Bart Van Assche <bvanassche@acm.org> | |
| 36 | Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> | |
| 37 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
| 38 | --- | |
| 39 | drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++---- | |
| 40 | 1 file changed, 2 insertions(+), 4 deletions(-) | |
| 41 | ||
| 42 | diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c | |
| 43 | index 12dc7100bb4c..d1154baa9436 100644 | |
| 44 | --- a/drivers/scsi/device_handler/scsi_dh_alua.c | |
| 45 | +++ b/drivers/scsi/device_handler/scsi_dh_alua.c | |
| 46 | @@ -1173,10 +1173,8 @@ static int __init alua_init(void) | |
| 47 | int r; | |
| 48 | ||
| 49 | kaluad_wq = alloc_workqueue("kaluad", WQ_MEM_RECLAIM, 0); | |
| 50 | - if (!kaluad_wq) { | |
| 51 | - /* Temporary failure, bypass */ | |
| 52 | - return SCSI_DH_DEV_TEMP_BUSY; | |
| 53 | - } | |
| 54 | + if (!kaluad_wq) | |
| 55 | + return -ENOMEM; | |
| 56 | ||
| 57 | r = scsi_register_device_handler(&alua_dh); | |
| 58 | if (r != 0) { | |
| 59 | -- | |
| 60 | 2.20.1 | |
| 61 |