releases/4.19.54/scsi-scsi_dh_alua-fix-possible-null-ptr-deref.patch

   1 From 69c5cf352e44af886b99851724602b1e6a5af5db Mon Sep 17 00:00:00 2001
   2 From: YueHaibing <yuehaibing@huawei.com>
   3 Date: Mon, 27 May 2019 22:22:09 +0800
   4 Subject: scsi: scsi_dh_alua: Fix possible null-ptr-deref
   5
   6 [ Upstream commit 12e750bc62044de096ab9a95201213fd912b9994 ]
   7
   8 If alloc_workqueue fails in alua_init, it should return -ENOMEM, otherwise
   9 it will trigger null-ptr-deref while unloading module which calls
  10 destroy_workqueue dereference
  11 wq->lock like this:
  12
  13 BUG: KASAN: null-ptr-deref in __lock_acquire+0x6b4/0x1ee0
  14 Read of size 8 at addr 0000000000000080 by task syz-executor.0/7045
  15
  16 CPU: 0 PID: 7045 Comm: syz-executor.0 Tainted: G         C        5.1.0+ #28
  17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1
  18 Call Trace:
  19  dump_stack+0xa9/0x10e
  20  __kasan_report+0x171/0x18d
  21  ? __lock_acquire+0x6b4/0x1ee0
  22  kasan_report+0xe/0x20
  23  __lock_acquire+0x6b4/0x1ee0
  24  lock_acquire+0xb4/0x1b0
  25  __mutex_lock+0xd8/0xb90
  26  drain_workqueue+0x25/0x290
  27  destroy_workqueue+0x1f/0x3f0
  28  __x64_sys_delete_module+0x244/0x330
  29  do_syscall_64+0x72/0x2a0
  30  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  31
  32 Reported-by: Hulk Robot <hulkci@huawei.com>
  33 Fixes: 03197b61c5ec ("scsi_dh_alua: Use workqueue for RTPG")
  34 Signed-off-by: YueHaibing <yuehaibing@huawei.com>
  35 Reviewed-by: Bart Van Assche <bvanassche@acm.org>
  36 Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
  37 Signed-off-by: Sasha Levin <sashal@kernel.org>
  38 ---
  39  drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++----
  40  1 file changed, 2 insertions(+), 4 deletions(-)
  41
  42 diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
  43 index 12dc7100bb4c..d1154baa9436 100644
  44 --- a/drivers/scsi/device_handler/scsi_dh_alua.c
  45 +++ b/drivers/scsi/device_handler/scsi_dh_alua.c
  46 @@ -1173,10 +1173,8 @@ static int __init alua_init(void)
  47         int r;
  48
  49         kaluad_wq = alloc_workqueue("kaluad", WQ_MEM_RECLAIM, 0);
  50 -       if (!kaluad_wq) {
  51 -               /* Temporary failure, bypass */
  52 -               return SCSI_DH_DEV_TEMP_BUSY;
  53 -       }
  54 +       if (!kaluad_wq)
  55 +               return -ENOMEM;
  56
  57         r = scsi_register_device_handler(&alua_dh);
  58         if (r != 0) {
  59 --
  60 2.20.1
  61