lkml.org 
[lkml]   [2022]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed
From
On 4/19/22 16:28, Wenchao Hao wrote:
> Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd
> if host reset failed. If host reset failed and eh_cmd_q of shost is not empty,
> these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs()
> and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related
> request would be freed.
>
Yes.

> While since host reset failed, we can not guarantee the LLDDs has cleared all
> references to these commands in eh_cmd_q. Is there any possibility that the
> LLDDs reference to these commands? If this happened, then a using after free
> issue would occur.
>
If host reset has failed there are _no_ assumptions we can make about
commands, and not even about the PCI device itself.
So in effect, once host_reset failed the system is hosed.

We _might_ be able to resurrect the system by doing PCI EEH, but not
many systems nor drivers implement that.

Cheers,

Hannes

\
 
 \ /
  Last update: 2022-04-19 16:58    [W:0.301 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site