Skip to content

Commit

Permalink
scsi: qedi: Fix use after free during abort cleanup
Browse files Browse the repository at this point in the history 
If qedi_tmf_work's qedi_wait_for_cleanup_request call times out we will
also force the clean up of the qedi_work_map but
qedi_process_cmd_cleanup_resp could still be accessing the qedi_cmd.

To fix this issue we extend where we hold the tmf_work_lock and back_lock
so the qedi_process_cmd_cleanup_resp access is serialized with the cleanup
done in qedi_tmf_work and any completion handling for the iscsi_task.

Link: https://lore.kernel.org/r/20210525181821.7617-22-michael.christie@oracle.com
Reviewed-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
  • Loading branch information
Mike Christie authored and Martin K. Petersen committed Jun 2, 2021
1 parent 2ce0023 commit 5b04d05
Show file tree
Hide file tree
Showing 2 changed files with 63 additions and 51 deletions.
113 changes: 62 additions & 51 deletions drivers/scsi/qedi/qedi_fw.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -729,7 +729,6 @@ static void qedi_process_nopin_local_cmpl(struct qedi_ctx *qedi,

static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
struct iscsi_cqe_solicited *cqe,
struct iscsi_task *task,
struct iscsi_conn *conn)
{
struct qedi_work_map *work, *work_tmp;
Expand All @@ -741,7 +740,7 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
u32 iscsi_cid;
struct qedi_conn *qedi_conn;
struct qedi_cmd *dbg_cmd;
struct iscsi_task *mtask;
struct iscsi_task *mtask, *task;
struct iscsi_tm *tmf_hdr = NULL;

iscsi_cid = cqe->conn_id;
Expand All @@ -767,59 +766,55 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
}
found = 1;
mtask = qedi_cmd->task;
task = work->ctask;
tmf_hdr = (struct iscsi_tm *)mtask->hdr;

list_del_init(&work->list);
kfree(work);
qedi_cmd->list_tmf_work = NULL;
}
}
spin_unlock_bh(&qedi_conn->tmf_work_lock);

if (found) {
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_SCSI_TM,
"TMF work, cqe->tid=0x%x, tmf flags=0x%x, cid=0x%x\n",
proto_itt, tmf_hdr->flags, qedi_conn->iscsi_conn_id);

if ((tmf_hdr->flags & ISCSI_FLAG_TM_FUNC_MASK) ==
ISCSI_TM_FUNC_ABORT_TASK) {
spin_lock_bh(&conn->session->back_lock);

protoitt = build_itt(get_itt(tmf_hdr->rtt),
conn->session->age);
task = iscsi_itt_to_task(conn, protoitt);

spin_unlock_bh(&conn->session->back_lock);
if (!found) {
spin_unlock_bh(&qedi_conn->tmf_work_lock);
goto check_cleanup_reqs;
}

if (!task) {
QEDI_NOTICE(&qedi->dbg_ctx,
"IO task completed, tmf rtt=0x%x, cid=0x%x\n",
get_itt(tmf_hdr->rtt),
qedi_conn->iscsi_conn_id);
return;
}
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_SCSI_TM,
"TMF work, cqe->tid=0x%x, tmf flags=0x%x, cid=0x%x\n",
proto_itt, tmf_hdr->flags, qedi_conn->iscsi_conn_id);

spin_lock_bh(&conn->session->back_lock);
if (iscsi_task_is_completed(task)) {
QEDI_NOTICE(&qedi->dbg_ctx,
"IO task completed, tmf rtt=0x%x, cid=0x%x\n",
get_itt(tmf_hdr->rtt), qedi_conn->iscsi_conn_id);
goto unlock;
}

dbg_cmd = task->dd_data;
dbg_cmd = task->dd_data;

QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_SCSI_TM,
"Abort tmf rtt=0x%x, i/o itt=0x%x, i/o tid=0x%x, cid=0x%x\n",
get_itt(tmf_hdr->rtt), get_itt(task->itt),
dbg_cmd->task_id, qedi_conn->iscsi_conn_id);
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_SCSI_TM,
"Abort tmf rtt=0x%x, i/o itt=0x%x, i/o tid=0x%x, cid=0x%x\n",
get_itt(tmf_hdr->rtt), get_itt(task->itt), dbg_cmd->task_id,
qedi_conn->iscsi_conn_id);

if (qedi_cmd->state == CLEANUP_WAIT_FAILED)
qedi_cmd->state = CLEANUP_RECV;
spin_lock(&qedi_conn->list_lock);
if (likely(dbg_cmd->io_cmd_in_list)) {
dbg_cmd->io_cmd_in_list = false;
list_del_init(&dbg_cmd->io_cmd);
qedi_conn->active_cmd_count--;
}
spin_unlock(&qedi_conn->list_lock);
qedi_cmd->state = CLEANUP_RECV;
unlock:
spin_unlock_bh(&conn->session->back_lock);
spin_unlock_bh(&qedi_conn->tmf_work_lock);
wake_up_interruptible(&qedi_conn->wait_queue);
return;

spin_lock(&qedi_conn->list_lock);
if (likely(dbg_cmd->io_cmd_in_list)) {
dbg_cmd->io_cmd_in_list = false;
list_del_init(&dbg_cmd->io_cmd);
qedi_conn->active_cmd_count--;
}
spin_unlock(&qedi_conn->list_lock);
qedi_cmd->state = CLEANUP_RECV;
wake_up_interruptible(&qedi_conn->wait_queue);
}
} else if (qedi_conn->cmd_cleanup_req > 0) {
check_cleanup_reqs:
if (qedi_conn->cmd_cleanup_req > 0) {
spin_lock_bh(&conn->session->back_lock);
qedi_get_proto_itt(qedi, cqe->itid, &ptmp_itt);
protoitt = build_itt(ptmp_itt, conn->session->age);
Expand All @@ -842,6 +837,7 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_TID,
"Freeing tid=0x%x for cid=0x%x\n",
cqe->itid, qedi_conn->iscsi_conn_id);
qedi_clear_task_idx(qedi_conn->qedi, cqe->itid);

} else {
qedi_get_proto_itt(qedi, cqe->itid, &ptmp_itt);
Expand Down Expand Up @@ -944,8 +940,7 @@ void qedi_fp_process_cqes(struct qedi_work *work)
goto exit_fp_process;
case ISCSI_CQE_TYPE_TASK_CLEANUP:
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_SCSI_TM, "CleanUp CqE\n");
qedi_process_cmd_cleanup_resp(qedi, &cqe->cqe_solicited, task,
conn);
qedi_process_cmd_cleanup_resp(qedi, &cqe->cqe_solicited, conn);
goto exit_fp_process;
default:
QEDI_ERR(&qedi->dbg_ctx, "Error cqe.\n");
Expand Down Expand Up @@ -1372,11 +1367,25 @@ static void qedi_tmf_work(struct work_struct *work)
tmf_hdr = (struct iscsi_tm *)mtask->hdr;
set_bit(QEDI_CONN_FW_CLEANUP, &qedi_conn->flags);

ctask = iscsi_itt_to_task(conn, tmf_hdr->rtt);
if (!ctask || !ctask->sc) {
QEDI_ERR(&qedi->dbg_ctx, "Task already completed\n");
goto abort_ret;
spin_lock_bh(&conn->session->back_lock);
ctask = iscsi_itt_to_ctask(conn, tmf_hdr->rtt);
if (!ctask) {
spin_unlock_bh(&conn->session->back_lock);
QEDI_ERR(&qedi->dbg_ctx, "Invalid RTT. Letting abort timeout.\n");
goto clear_cleanup;
}

if (iscsi_task_is_completed(ctask)) {
spin_unlock_bh(&conn->session->back_lock);
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
"Task already completed\n");
/*
* We have to still send the TMF because libiscsi needs the
* response to avoid a timeout.
*/
goto send_tmf;
}
spin_unlock_bh(&conn->session->back_lock);

cmd = (struct qedi_cmd *)ctask->dd_data;
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
Expand All @@ -1387,19 +1396,20 @@ static void qedi_tmf_work(struct work_struct *work)
if (qedi_do_not_recover) {
QEDI_ERR(&qedi->dbg_ctx, "DONT SEND CLEANUP/ABORT %d\n",
qedi_do_not_recover);
goto abort_ret;
goto clear_cleanup;
}

list_work = kzalloc(sizeof(*list_work), GFP_ATOMIC);
if (!list_work) {
QEDI_ERR(&qedi->dbg_ctx, "Memory allocation failed\n");
goto abort_ret;
goto clear_cleanup;
}

qedi_cmd->type = TYPEIO;
list_work->qedi_cmd = qedi_cmd;
list_work->rtid = cmd->task_id;
list_work->state = QEDI_WORK_SCHEDULED;
list_work->ctask = ctask;
qedi_cmd->list_tmf_work = list_work;

QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_SCSI_TM,
Expand All @@ -1422,6 +1432,7 @@ static void qedi_tmf_work(struct work_struct *work)
goto ldel_exit;
}

send_tmf:
tid = qedi_get_task_idx(qedi);
if (tid == -1) {
QEDI_ERR(&qedi->dbg_ctx, "Invalid tid, cid=0x%x\n",
Expand All @@ -1432,7 +1443,7 @@ static void qedi_tmf_work(struct work_struct *work)
qedi_cmd->task_id = tid;
qedi_send_iscsi_tmf(qedi_conn, qedi_cmd->task);

abort_ret:
clear_cleanup:
clear_bit(QEDI_CONN_FW_CLEANUP, &qedi_conn->flags);
return;

Expand Down
1 change: 1 addition & 0 deletions drivers/scsi/qedi/qedi_iscsi.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,7 @@ struct qedi_cmd {
struct qedi_work_map {
struct list_head list;
struct qedi_cmd *qedi_cmd;
struct iscsi_task *ctask;
int rtid;

int state;
Expand Down

0 comments on commit 5b04d05

Please sign in to comment.