lkml.org 
[lkml]   [2023]   [Dec]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] scsi: mpt3sas: fix potential use-after-free in mpt3sas_base_attach
Date
_base_allocate_memory_pools() calls _base_release_memory_pools()
to clean up memory in several error paths. However,
mpt3sas_base_attach() calls _base_release_memory_pools() again
on failure of _base_allocate_memory_pools(), which may lead to
use-after-free.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
---
drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index a75f670bf551..9be7e493e56c 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -5844,6 +5844,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
}
dma_pool_destroy(ioc->reply_post_free_array_dma_pool);
kfree(ioc->reply_post);
+ ioc->reply_post = NULL;
}

if (ioc->pcie_sgl_dma_pool) {
@@ -5854,6 +5855,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
ioc->pcie_sg_lookup[i].pcie_sgl = NULL;
}
dma_pool_destroy(ioc->pcie_sgl_dma_pool);
+ ioc->pcie_sgl_dma_pool = NULL;
}
kfree(ioc->pcie_sg_lookup);
ioc->pcie_sg_lookup = NULL;
@@ -5864,6 +5866,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
ioc->config_page));
dma_free_coherent(&ioc->pdev->dev, ioc->config_page_sz,
ioc->config_page, ioc->config_page_dma);
+ ioc->config_page = NULL;
}

kfree(ioc->hpr_lookup);
--
2.17.1

\
 
 \ /
  Last update: 2023-12-25 07:38    [W:0.058 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site