linux-stable.git/drivers/scsi, branch v4.8.5

scsi: Fix use-after-free

2016-10-28T07:45:26+00:00

commit bcd8f2e94808fcddf6ef3af5f060a36820dcc432 upstream.

This patch fixes one use-after-free report[1] by KASAN.

In __scsi_scan_target(), when a type 31 device is probed,
SCSI_SCAN_TARGET_PRESENT is returned and the target will be scanned
again.

Inside the following scsi_report_lun_scan(), one new scsi_device
instance is allocated, and scsi_probe_and_add_lun() is called again to
probe the target and still see type 31 device, finally
__scsi_remove_device() is called to remove & free the device at the end
of scsi_probe_and_add_lun(), so cause use-after-free in
scsi_report_lun_scan().

And the following SCSI log can be observed:

	scsi 0:0:2:0: scsi scan: INQUIRY pass 1 length 36
	scsi 0:0:2:0: scsi scan: INQUIRY successful with code 0x0
	scsi 0:0:2:0: scsi scan: peripheral device type of 31, no device added
	scsi 0:0:2:0: scsi scan: Sending REPORT LUNS to (try 0)
	scsi 0:0:2:0: scsi scan: REPORT LUNS successful (try 0) result 0x0
	scsi 0:0:2:0: scsi scan: REPORT LUN scan
	scsi 0:0:2:0: scsi scan: INQUIRY pass 1 length 36
	scsi 0:0:2:0: scsi scan: INQUIRY successful with code 0x0
	scsi 0:0:2:0: scsi scan: peripheral device type of 31, no device added
	BUG: KASAN: use-after-free in __scsi_scan_target+0xbf8/0xe40 at addr ffff88007b44a104

This patch fixes the issue by moving the putting reference at
the end of scsi_report_lun_scan().

[1] KASAN report
==================================================================
[    3.274597] PM: Adding info for serio:serio1
[    3.275127] BUG: KASAN: use-after-free in __scsi_scan_target+0xd87/0xdf0 at addr ffff880254d8c304
[    3.275653] Read of size 4 by task kworker/u10:0/27
[    3.275903] CPU: 3 PID: 27 Comm: kworker/u10:0 Not tainted 4.8.0 #2121
[    3.276258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[    3.276797] Workqueue: events_unbound async_run_entry_fn
[    3.277083]  ffff880254d8c380 ffff880259a37870 ffffffff94bbc6c1 ffff880078402d80
[    3.277532]  ffff880254d8bb80 ffff880259a37898 ffffffff9459fec1 ffff880259a37930
[    3.277989]  ffff880254d8bb80 ffff880078402d80 ffff880259a37920 ffffffff945a0165
[    3.278436] Call Trace:
[    3.278528]  [] dump_stack+0x65/0x84
[    3.278797]  [] kasan_object_err+0x21/0x70
[    3.279063] device: 'psaux': device_add
[    3.279616]  [] kasan_report_error+0x205/0x500
[    3.279651] PM: Adding info for No Bus:psaux
[    3.280202]  [] ? kfree_const+0x22/0x30
[    3.280486]  [] ? kobject_release+0x119/0x370
[    3.280805]  [] __asan_report_load4_noabort+0x43/0x50
[    3.281170]  [] ? __scsi_scan_target+0xd87/0xdf0
[    3.281506]  [] __scsi_scan_target+0xd87/0xdf0
[    3.281848]  [] ? scsi_add_device+0x30/0x30
[    3.282156]  [] ? pm_runtime_autosuspend_expiration+0x60/0x60
[    3.282570]  [] ? _raw_spin_lock+0x17/0x40
[    3.282880]  [] scsi_scan_channel+0x105/0x160
[    3.283200]  [] scsi_scan_host_selected+0x212/0x2f0
[    3.283563]  [] do_scsi_scan_host+0x1bc/0x250
[    3.283882]  [] do_scan_async+0x41/0x450
[    3.284173]  [] async_run_entry_fn+0xfe/0x610
[    3.284492]  [] ? pwq_dec_nr_in_flight+0x124/0x2a0
[    3.284876]  [] ? preempt_count_add+0x130/0x160
[    3.285207]  [] process_one_work+0x544/0x12d0
[    3.285526]  [] worker_thread+0xd9/0x12f0
[    3.285844]  [] ? process_one_work+0x12d0/0x12d0
[    3.286182]  [] kthread+0x1c5/0x260
[    3.286443]  [] ? __switch_to+0x88d/0x1430
[    3.286745]  [] ? kthread_worker_fn+0x5a0/0x5a0
[    3.287085]  [] ret_from_fork+0x1f/0x40
[    3.287368]  [] ? kthread_worker_fn+0x5a0/0x5a0
[    3.287697] Object at ffff880254d8bb80, in cache kmalloc-2048 size: 2048
[    3.288064] Allocated:
[    3.288147] PID = 27
[    3.288218]  [] save_stack_trace+0x2b/0x50
[    3.288531]  [] save_stack+0x46/0xd0
[    3.288806]  [] kasan_kmalloc+0xad/0xe0
[    3.289098]  [] __kmalloc+0x13e/0x250
[    3.289378]  [] scsi_alloc_sdev+0xea/0xcf0
[    3.289701]  [] __scsi_scan_target+0xa06/0xdf0
[    3.290034]  [] scsi_scan_channel+0x105/0x160
[    3.290362]  [] scsi_scan_host_selected+0x212/0x2f0
[    3.290724]  [] do_scsi_scan_host+0x1bc/0x250
[    3.291055]  [] do_scan_async+0x41/0x450
[    3.291354]  [] async_run_entry_fn+0xfe/0x610
[    3.291695]  [] process_one_work+0x544/0x12d0
[    3.292022]  [] worker_thread+0xd9/0x12f0
[    3.292325]  [] kthread+0x1c5/0x260
[    3.292594]  [] ret_from_fork+0x1f/0x40
[    3.292886] Freed:
[    3.292945] PID = 27
[    3.293016]  [] save_stack_trace+0x2b/0x50
[    3.293327]  [] save_stack+0x46/0xd0
[    3.293600]  [] kasan_slab_free+0x71/0xb0
[    3.293916]  [] kfree+0xa2/0x1f0
[    3.294168]  [] scsi_device_dev_release_usercontext+0x50a/0x730
[    3.294598]  [] execute_in_process_context+0xda/0x130
[    3.294974]  [] scsi_device_dev_release+0x1c/0x20
[    3.295322]  [] device_release+0x76/0x1e0
[    3.295626]  [] kobject_release+0x107/0x370
[    3.295942]  [] kobject_put+0x4e/0xa0
[    3.296222]  [] put_device+0x17/0x20
[    3.296497]  [] scsi_device_put+0x7c/0xa0
[    3.296801]  [] __scsi_scan_target+0xd4c/0xdf0
[    3.297132]  [] scsi_scan_channel+0x105/0x160
[    3.297458]  [] scsi_scan_host_selected+0x212/0x2f0
[    3.297829]  [] do_scsi_scan_host+0x1bc/0x250
[    3.298156]  [] do_scan_async+0x41/0x450
[    3.298453]  [] async_run_entry_fn+0xfe/0x610
[    3.298777]  [] process_one_work+0x544/0x12d0
[    3.299105]  [] worker_thread+0xd9/0x12f0
[    3.299408]  [] kthread+0x1c5/0x260
[    3.299676]  [] ret_from_fork+0x1f/0x40
[    3.299967] Memory state around the buggy address:
[    3.300209]  ffff880254d8c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    3.300608]  ffff880254d8c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    3.300986] >ffff880254d8c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    3.301408]                    ^
[    3.301550]  ffff880254d8c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[    3.301987]  ffff880254d8c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    3.302396]
==================================================================

Cc: Christoph Hellwig 
Signed-off-by: Ming Lei 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: ibmvfc: Fix I/O hang when port is not mapped

2016-10-22T10:40:24+00:00

commit 07d0e9a847401ffd2f09bd450d41644cd090e81d upstream.

If a VFC port gets unmapped in the VIOS, it may not respond with a CRQ
init complete following H_REG_CRQ. If this occurs, we can end up having
called scsi_block_requests and not a resulting unblock until the init
complete happens, which may never occur, and we end up hanging I/O
requests.  This patch ensures the host action stay set to
IBMVFC_HOST_ACTION_TGT_DEL so we move all rports into devloss state and
unblock unless we receive an init complete.

Signed-off-by: Brian King 
Acked-by: Tyrel Datwyler 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: arcmsr: Simplify user_len checking

2016-10-22T10:40:24+00:00

commit 4bd173c30792791a6daca8c64793ec0a4ae8324f upstream.

Do the user_len check first and then the ver_addr allocation so that we
can save us the kfree() on the error path when user_len is >
ARCMSR_API_DATA_BUFLEN.

Signed-off-by: Borislav Petkov 
Cc: Marco Grassi 
Cc: Dan Carpenter 
Cc: Tomas Henzl 
Cc: Martin K. Petersen 
Reviewed-by: Johannes Thumshirn 
Reviewed-by: Tomas Henzl 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()

2016-10-22T10:40:24+00:00

commit 7bc2b55a5c030685b399bb65b6baa9ccc3d1f167 upstream.

We need to put an upper bound on "user_len" so the memcpy() doesn't
overflow.

Reported-by: Marco Grassi 
Signed-off-by: Dan Carpenter 
Reviewed-by: Tomas Henzl 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: configure runtime pm before calling device_add in scsi_add_host_with_dma

2016-10-20T08:03:30+00:00

commit 0d5644b7d8daa3c1d91acb4367731f568c9c9469 upstream.

Runtime PM should be configured already once we call device_add. See
also the description in this mail thread
https://lists.linuxfoundation.org/pipermail/linux-pm/2009-November/023198.html
or the order of calls e.g. in usb_new_device.

The changed order also helps to avoid scenarios where runtime pm for
&shost->shost_gendev is activated whilst the parent is suspended,
resulting in error message "runtime PM trying to activate child device
hostx but parent yyy is not active".

In addition properly reverse the runtime pm calls in the error path.

Signed-off-by: Heiner Kallweit 
Acked-by: Alan Stern 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2016-10-01T14:37:15+00:00

Pull SCSI fix from James Bottomley:
 "One final fix before 4.8.

  There was a memory leak triggered by turning scsi mq off due to the
  fact that we assume on host release that the already running hosts
  weren't mq based because that's the state of the global flag (even
  though they were).

  Fix it by tracking this on a per host host basis"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: Avoid that toggling use_blk_mq triggers a memory leak

Merge remote-tracking branch 'mkp-scsi/4.8/scsi-fixes' into fixes

2016-09-28T05:30:51+00:00

scsi: Avoid that toggling use_blk_mq triggers a memory leak

2016-09-27T00:58:42+00:00

This patch avoids that the following memory leak is triggered if
use_blk_mq is disabled after a SCSI host has been allocated by the
ib_srp driver and before the same SCSI host is freed:

unreferenced object 0xffff8803a168c568 (size 256):
  backtrace:
    [] kmemleak_alloc+0x45/0xa0
    [] __kmalloc_node+0x1e4/0x400
    [] blk_mq_alloc_tag_set+0xb4/0x230
    [] scsi_mq_setup_tags+0xc7/0xd0
    [] scsi_add_host_with_dma+0x216/0x2d0
    [] srp_create_target+0xe55/0x13d0 [ib_srp]
    [] dev_attr_store+0x13/0x20
    [] sysfs_kf_write+0x40/0x50
    [] kernfs_fop_write+0x137/0x1c0
    [] __vfs_write+0x23/0x140
    [] vfs_write+0xb0/0x190
    [] SyS_write+0x44/0xa0
    [] entry_SYSCALL_64_fastpath+0x18/0xa8

Fixes: 9aa9cc4221f5 ("scsi: remove the disable_blk_mq host flag")
Signed-off-by: Bart Van Assche 
Cc: Christoph Hellwig 
Cc: Martin K. Petersen 
Cc: 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2016-09-06T18:06:52+00:00

Pull SCSI fixes from James Bottomley:
 "This is really three fixes, but the SES one comes in a bundle of three
  (making the replacement API available properly, using it and removing
  the non-working one).  The SES problem causes an oops on hpsa devices
  because they attach virtual disks to the host which aren't SAS
  attached (the replacement API ignores them).

  The other two fixes are fairly minor: the sense key one means we
  actually resolve a newly added sense key and the RDAC device
  blacklisting is needed to prevent us annoying the universal XPORT lun
  of various RDAC arrays"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: sas: remove is_sas_attached()
  scsi: ses: use scsi_is_sas_rphy instead of is_sas_attached
  scsi: sas: provide stub implementation for scsi_is_sas_rphy
  scsi: blacklist all RDAC devices for BLIST_NO_ULD_ATTACH
  scsi: fix upper bounds check of sense key in scsi_sense_key_string()

drivers/scsi/wd719x.c: remove last declaration using DEFINE_PCI_DEVICE_TABLE

2016-09-02T00:52:01+00:00

Convert it to the preferred const struct pci_device_id instead.

Link: http://lkml.kernel.org/r/95c5e4100c3cd4eda643624f5b70e8d7abceb86c.1472660229.git.joe@perches.com
Signed-off-by: Joe Perches 
Reviewed-by: Bart Van Assche 
Cc: "James E.J. Bottomley" 
Cc: "Martin K. Petersen" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds