Messages in this thread | | | Date | Tue, 19 Apr 2022 16:56:53 +0200 | Subject | Re: [Question] SCSI_EH: How does EH guarantee there is no UAF of scsi_cmnd if host reset failed | From | Hannes Reinecke <> |
| |
On 4/19/22 16:28, Wenchao Hao wrote: > Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd > if host reset failed. If host reset failed and eh_cmd_q of shost is not empty, > these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs() > and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related > request would be freed. > Yes.
> While since host reset failed, we can not guarantee the LLDDs has cleared all > references to these commands in eh_cmd_q. Is there any possibility that the > LLDDs reference to these commands? If this happened, then a using after free > issue would occur. > If host reset has failed there are _no_ assumptions we can make about commands, and not even about the PCI device itself. So in effect, once host_reset failed the system is hosed.
We _might_ be able to resurrect the system by doing PCI EEH, but not many systems nor drivers implement that.
Cheers,
Hannes
| |