github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-08-28 03:31:47 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1710ac1754
linux/drivers
History
Himanshu Madhani 1710ac1754 scsi: qla2xxx: Fix read offset in qla24xx_load_risc_flash() 
This patch fixes regression introduced by commit f8f97b0c5b ("scsi:
qla2xxx: Cleanups for NVRAM/Flash read/write path") where flash read/write
routine cleanup left out code which resulted into checksum failure leading
to use-after-free stack during driver load.

Following stack trace is seen in the log file

qla2xxx [0000:00:00.0]-0005: : QLogic Fibre Channel HBA Driver: 10.01.00.16-k.
qla2xxx [0000:00:0b.0]-001d: : Found an ISP2532 irq 11 iobase 0x0000000000f47f03.
qla2xxx [0000:00:0b.0]-00cd:8: ISP Firmware failed checksum.
qla2xxx [0000:00:0b.0]-00cf:8: Setup chip ****FAILED****.
qla2xxx [0000:00:0b.0]-00d6:8: Failed to initialize adapter - Adapter flags 2.
==================================================================
BUG: KASAN: use-after-free in __list_del_entry_valid+0x15/0xd0
Read of size 8 at addr ffff8880ca05a490 by task modprobe/857

CPU: 0 PID: 857 Comm: modprobe Not tainted 5.1.0-rc1-dbg+ #4
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
  dump_stack+0x86/0xca
  print_address_description+0x6c/0x234
  ? __list_del_entry_valid+0x15/0xd0
  kasan_report.cold.3+0x1b/0x34
  ? __list_del_entry_valid+0x15/0xd0
  ? __kmem_cache_shutdown.cold.95+0xf5/0x176
  ? __list_del_entry_valid+0x15/0xd0
  __asan_load8+0x54/0x90
  __list_del_entry_valid+0x15/0xd0
  dma_pool_destroy+0x4f/0x260
  ? dma_free_attrs+0xb4/0xd0
  qla2x00_mem_free+0x529/0xcc0 [qla2xxx]
  ? kobject_put+0xdb/0x230
  qla2x00_probe_one+0x2b5e/0x45f0 [qla2xxx]
  ? qla2xxx_pci_error_detected+0x210/0x210 [qla2xxx]
  ? match_held_lock+0x20/0x240
  ? find_held_lock+0xca/0xf0
  ? mark_held_locks+0x86/0xb0
  ? _raw_spin_unlock_irqrestore+0x52/0x60
  ? __pm_runtime_resume+0x5b/0xb0
  ? lockdep_hardirqs_on+0x185/0x260
  ? _raw_spin_unlock_irqrestore+0x52/0x60
  ? trace_hardirqs_on+0x24/0x130
  ? preempt_count_sub+0x13/0xc0
  ? _raw_spin_unlock_irqrestore+0x3d/0x60
  pci_device_probe+0x154/0x1e0
  really_probe+0x17d/0x540
  ? device_driver_attach+0x90/0x90
  driver_probe_device+0x113/0x170
  ? device_driver_attach+0x90/0x90
  device_driver_attach+0x88/0x90
  __driver_attach+0xb5/0x190
  bus_for_each_dev+0xf8/0x160
  ? subsys_dev_iter_exit+0x10/0x10
  ? kasan_check_read+0x11/0x20
  ? preempt_count_sub+0x13/0xc0
  ? _raw_spin_unlock+0x2c/0x50
  driver_attach+0x26/0x30
  bus_add_driver+0x238/0x2f0
  driver_register+0xd7/0x150
  __pci_register_driver+0xd5/0xe0
  ? 0xffffffffa06c8000
  qla2x00_module_init+0x208/0x254 [qla2xxx]
  do_one_initcall+0xc0/0x3c9
  ? trace_event_raw_event_initcall_finish+0x150/0x150
  ? __kasan_kmalloc.constprop.5+0xc7/0xd0
  ? kasan_unpoison_shadow+0x35/0x50
  ? kasan_poison_shadow+0x2f/0x40
  ? __asan_register_globals+0x5a/0x70
  do_init_module+0x103/0x330
  load_module+0x36df/0x3b70
  ? fsnotify+0x611/0x640
  ? module_frob_arch_sections+0x20/0x20
  ? kernel_read+0x74/0xa0
  ? kasan_check_write+0x14/0x20
  ? kernel_read_file+0x25e/0x320
  ? do_mmap+0x42c/0x6c0
  __do_sys_finit_module+0x133/0x1c0
  ? __do_sys_finit_module+0x133/0x1c0
  ? __do_sys_init_module+0x210/0x210
  ? fput_many+0x1b/0xc0
  ? fput+0xe/0x10
  ? do_syscall_64+0x14/0x210
  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
  __x64_sys_finit_module+0x3e/0x50
  do_syscall_64+0x72/0x210
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f8bd5c03219
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 47 fc 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007fff9d11de98 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000055ef21596b50 RCX: 00007f8bd5c03219
RDX: 0000000000000000 RSI: 000055ef21596570 RDI: 0000000000000004
RBP: 000055ef21596570 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
R13: 000055ef21596c80 R14: 0000000000040000 R15: 000055ef21596b50

Allocated by task 857:
  save_stack+0x43/0xd0
  __kasan_kmalloc.constprop.5+0xc7/0xd0
  kasan_kmalloc+0x9/0x10
  kmem_cache_alloc_trace+0x144/0x300
  dma_pool_create+0xb5/0x3b0
  qla2x00_mem_alloc+0xb98/0x1ad0 [qla2xxx]
  qla2x00_probe_one+0xe28/0x45f0 [qla2xxx]
  pci_device_probe+0x154/0x1e0
  really_probe+0x17d/0x540
  driver_probe_device+0x113/0x170
  device_driver_attach+0x88/0x90
  __driver_attach+0xb5/0x190
  bus_for_each_dev+0xf8/0x160
  driver_attach+0x26/0x30
  bus_add_driver+0x238/0x2f0
  driver_register+0xd7/0x150
  __pci_register_driver+0xd5/0xe0
  qla2x00_module_init+0x208/0x254 [qla2xxx]
  do_one_initcall+0xc0/0x3c9
  do_init_module+0x103/0x330
  load_module+0x36df/0x3b70
  __do_sys_finit_module+0x133/0x1c0
  __x64_sys_finit_module+0x3e/0x50
  do_syscall_64+0x72/0x210
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 857:
  save_stack+0x43/0xd0
  __kasan_slab_free+0x139/0x190
  kasan_slab_free+0xe/0x10
  kfree+0xf0/0x2c0
  dma_pool_destroy+0x24c/0x260
  qla2x00_mem_free+0x529/0xcc0 [qla2xxx]
  qla2x00_free_device+0x167/0x1b0 [qla2xxx]
  qla2x00_probe_one+0x2b28/0x45f0 [qla2xxx]
  pci_device_probe+0x154/0x1e0
  really_probe+0x17d/0x540
  driver_probe_device+0x113/0x170
  device_driver_attach+0x88/0x90
  __driver_attach+0xb5/0x190
  bus_for_each_dev+0xf8/0x160
  driver_attach+0x26/0x30
  bus_add_driver+0x238/0x2f0
  driver_register+0xd7/0x150
  __pci_register_driver+0xd5/0xe0
  qla2x00_module_init+0x208/0x254 [qla2xxx]
  do_one_initcall+0xc0/0x3c9
  do_init_module+0x103/0x330
  load_module+0x36df/0x3b70
  __do_sys_finit_module+0x133/0x1c0
  __x64_sys_finit_module+0x3e/0x50
  do_syscall_64+0x72/0x210
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880ca05a400
  which belongs to the cache kmalloc-192 of size 192
The buggy address is located 144 bytes inside of
  192-byte region [ffff8880ca05a400, ffff8880ca05a4c0)
The buggy address belongs to the page:
page:ffffea0003281680 count:1 mapcount:0 mapping:ffff88811bf03380 index:0x0 compound_mapcount: 0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 0000000000000000 0000000c00000001 ffff88811bf03380
raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8880ca05a380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
  ffff8880ca05a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880ca05a480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                          ^
  ffff8880ca05a500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffff8880ca05a580: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
==================================================================

Fixes: f8f97b0c5b ("scsi: qla2xxx: Cleanups for NVRAM/Flash read/write path")
Reported-by: Bart Van Assche <bvanassche@acm.org>
Tested-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2019-04-15 22:08:04 -04:00
..
accessibility
acpi device-dax for 5.1 2019-03-16 13:05:32 -07:00
amba ARM: 8836/1: drivers: amba: Update component matching to use the CoreSight UCI values. 2019-02-26 11:23:49 +00:00
android
ata SCSI misc on 20190306 2019-03-09 16:53:47 -08:00
atm
auxdisplay
base device-dax for 5.1 2019-03-16 13:05:32 -07:00
bcma
block for-5.1/block-post-20190315 2019-03-16 12:36:39 -07:00
bluetooth Bluetooth: mediatek: add support for MediaTek MT7663U and MT7668U UART devices 2019-03-02 19:51:23 +01:00
bus ARM: SoC driver updates for 5.1 2019-03-06 09:41:12 -08:00
cdrom
char Merge branch 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2019-03-10 17:37:29 -07:00
clk We have a fairly balanced mix of clk driver updates and clk framework 2019-03-14 08:46:17 -07:00
clocksource ARM: some cleanups, direct physical timer assignment, cache sanitization 2019-03-15 15:00:28 -07:00
connector connector: fix unsafe usage of ->real_parent 2019-03-08 15:06:38 -08:00
cpufreq cpufreq: intel_pstate: Fix up iowait_boost computation 2019-03-12 09:47:30 +01:00
cpuidle cpuidle: governor: Add new governors to cpuidle_governors again 2019-03-12 23:46:55 +01:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-03-13 09:51:17 -07:00
dax device-dax for 5.1 2019-03-16 13:05:32 -07:00
dca
devfreq
dio
dma dmaengine updates for v5.1-rc1 2019-03-14 09:11:54 -07:00
dma-buf
edac Merge branch 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2019-03-08 09:11:39 -08:00
eisa
extcon
firewire
firmware memblock: drop memblock_alloc_*_nopanic() variants 2019-03-12 10:04:02 -07:00
fmc
fpga
fsi
gnss
gpio pci-v5.1-changes 2019-03-09 14:57:08 -08:00
gpu drm i915, amdgpu, qxl and etnaviv fixes 2019-03-15 13:58:35 -07:00
hid Merge branch 'for-5.1/wacom' into for-linus 2019-03-05 15:43:05 +01:00
hsi
hv Char/Misc driver patches for 5.1-rc1 2019-03-06 14:18:59 -08:00
hwmon hwmon: (ad7418) Add device tree probing 2019-02-25 09:06:00 -08:00
hwspinlock
hwtracing ARM updates for 5.1-rc1 2019-03-15 14:37:46 -07:00
i2c i2c: i2c-designware-platdrv: Always use a dynamic adapter number 2019-03-13 18:07:10 +01:00
i3c - Add a /* fall-through */ comment in the dw-i3c-master driver 2019-03-04 19:05:02 -08:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide 2019-03-11 09:34:00 -07:00
idle
iio - New Drivers 2019-03-08 10:02:58 -08:00
infiniband XArray updates for 5.1-rc1 2019-03-11 20:06:18 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2019-03-11 10:57:11 -07:00
interconnect
iommu IOMMU Fix for Linux v5.1-rc1 2019-03-15 14:41:30 -07:00
ipack
irqchip arm64 updates for 5.1: 2019-03-10 10:17:23 -07:00
isdn isdn: hfcpci: fix potential NULL pointer dereference 2019-03-12 14:36:02 -07:00
leds platform-drivers-x86 for v5.1-1 2019-03-10 13:16:37 -07:00
lightnvm pblk: fix max_io calculation 2019-03-07 08:59:26 -07:00
macintosh treewide: add checks for the return value of memblock_alloc*() 2019-03-12 10:04:02 -07:00
mailbox mailbox: imx: keep MU irq working during suspend/resume 2019-03-11 02:51:43 -05:00
mcb
md for-5.1/block-post-20190315 2019-03-16 12:36:39 -07:00
media DMA mapping updates for 5.1 2019-03-10 11:54:48 -07:00
memory
memstick
message scsi: mptscsih: Mark expected switch fall-throughs 2019-04-03 23:45:59 -04:00
mfd DMA mapping updates for 5.1 2019-03-10 11:54:48 -07:00
misc 5.1 Merge Window Pull Request 2019-03-09 15:53:03 -08:00
mmc for-5.1/block-20190302 2019-03-08 14:12:17 -08:00
mtd This pull request contains updates for both UBI and UBIFS: 2019-03-13 09:34:35 -07:00
mux
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-03-14 09:28:12 -07:00
nfc
ntb Fixes for switchtec debugability and mapping table entries, NTB 2019-03-15 14:32:59 -07:00
nubus
nvdimm device-dax for 5.1 2019-03-16 13:05:32 -07:00
nvme scsi: scsi_transport_fc: nvme: display FC-NVMe port roles 2019-04-12 20:09:34 -04:00
nvmem Char/Misc driver patches for 5.1-rc1 2019-03-06 14:18:59 -08:00
of of: fix kmemleak crash caused by imbalance in early memory reservation 2019-03-12 10:04:02 -07:00
opp PM / OPP: Update performance state when freq == old_freq 2019-03-12 09:45:56 +01:00
oprofile
parisc DMA mapping updates for 5.1 2019-03-10 11:54:48 -07:00
parport
pci IOMMU Updates for Linux v5.1 2019-03-10 12:29:52 -07:00
pcmcia
perf arm64 updates for 5.1: 2019-03-10 10:17:23 -07:00
phy scsi: phy: mediatek: Add UFS M-PHY driver 2019-03-19 16:56:21 -04:00
pinctrl This is the bulk of pin control changes for the v5.1 kernel cycle. 2019-03-11 11:12:50 -07:00
platform chrome platform changes for v5.1 2019-03-12 09:46:32 -07:00
pnp ACPI/ACPICA: Trivial: fix spelling mistakes and fix whitespace formatting 2019-02-24 21:12:01 +01:00
power
powercap
pps
ps3
ptp Merge branch 'timers-2038-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2019-03-05 14:08:26 -08:00
pwm pwm: atmel: Remove useless symbolic definitions 2019-03-04 12:52:49 +01:00
rapidio rapidio/mport_cdev: mark expected switch fall-through 2019-03-07 18:32:02 -08:00
ras
regulator regulator: mc13xxx: Constify regulator_ops variables 2019-03-04 00:01:08 +00:00
remoteproc remoteproc updates for v5.1 2019-03-14 09:00:06 -07:00
reset
rpmsg
rtc chrome platform changes for v5.1 2019-03-12 09:46:32 -07:00
s390 scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN 2019-03-27 21:26:12 -04:00
sbus
scsi scsi: qla2xxx: Fix read offset in qla24xx_load_risc_flash() 2019-04-15 22:08:04 -04:00
sfi
sh
siox
slimbus
sn
soc ARM: SoC driver updates for 5.1 2019-03-06 09:41:12 -08:00
soundwire
spi pci-v5.1-changes 2019-03-09 14:57:08 -08:00
spmi
ssb
staging media updates for v5.1-rc1 2019-03-09 14:45:54 -08:00
target scsi: target/iscsi: Make sure PDU processing continues if parsing a command fails 2019-04-12 20:20:06 -04:00
tc
tee ARM: SoC driver updates for 5.1 2019-03-06 09:41:12 -08:00
thermal Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal 2019-03-08 09:52:41 -08:00
thunderbolt
tty dmaengine updates for v5.1-rc1 2019-03-14 09:11:54 -07:00
uio
usb memblock: drop memblock_alloc_*_nopanic() variants 2019-03-12 10:04:02 -07:00
uwb
vfio powerpc updates for 5.1 2019-03-07 12:56:26 -08:00
vhost virtio: fixes, cleanups 2019-03-10 12:47:57 -07:00
video fbdev changes for v5.1: 2019-03-15 14:22:59 -07:00
virt virt: vbox: Mark expected switch fall-through 2019-02-27 16:00:20 +01:00
virtio virtio: hint if callbacks surprisingly might sleep 2019-03-06 11:19:57 -05:00
visorbus
vlynq
vme
w1
watchdog linux-watchdog 5.1-rc1 tag 2019-03-11 11:22:15 -07:00
xen xen/balloon: Fix mapping PG_offline pages to user space 2019-03-15 15:35:35 +01:00
zorro
Kconfig
Makefile IOMMU Updates for Linux v5.1 2019-03-10 12:29:52 -07:00