qjyu
/
OrangePi_CM5
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
OrangePi_CM5/drivers
History
Letu Ren 034b30c311 scsi: qedf: Fix a UAF bug in __qedf_probe() 
[ Upstream commit fbfe96869b782364caebae0445763969ddb6ea67 ]

In __qedf_probe(), if qedf->cdev is NULL which means
qed_ops->common->probe() failed, then the program will goto label err1, and
scsi_host_put() will free lport->host pointer. Because the memory qedf
points to is allocated by libfc_host_alloc(), it will be freed by
scsi_host_put(). However, the if statement below label err0 only checks
whether qedf is NULL but doesn't check whether the memory has been freed.
So a UAF bug can occur.

There are two ways to reach the statements below err0. The first one is
described as before, "qedf" should be set to NULL. The second one is goto
"err0" directly. In the latter scenario qedf hasn't been changed and it has
the initial value NULL. As a result the if statement is not reachable in
any situation.

The KASAN logs are as follows:

[    2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0
[    2.312969]
[    2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[    2.312969] Call Trace:
[    2.312969]  dump_stack_lvl+0x59/0x7b
[    2.312969]  print_address_description+0x7c/0x3b0
[    2.312969]  ? __qedf_probe+0x5dcf/0x6bc0
[    2.312969]  __kasan_report+0x160/0x1c0
[    2.312969]  ? __qedf_probe+0x5dcf/0x6bc0
[    2.312969]  kasan_report+0x4b/0x70
[    2.312969]  ? kobject_put+0x25d/0x290
[    2.312969]  kasan_check_range+0x2ca/0x310
[    2.312969]  __qedf_probe+0x5dcf/0x6bc0
[    2.312969]  ? selinux_kernfs_init_security+0xdc/0x5f0
[    2.312969]  ? trace_rpm_return_int_rcuidle+0x18/0x120
[    2.312969]  ? rpm_resume+0xa5c/0x16e0
[    2.312969]  ? qedf_get_generic_tlv_data+0x160/0x160
[    2.312969]  local_pci_probe+0x13c/0x1f0
[    2.312969]  pci_device_probe+0x37e/0x6c0

Link: https://lore.kernel.org/r/20211112120641.16073-1-fantasquex@gmail.com
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Acked-by: Saurav Kashyap <skashyap@marvell.com>
Co-developed-by: Wende Tan <twd2.me@gmail.com>
Signed-off-by: Wende Tan <twd2.me@gmail.com>
Signed-off-by: Letu Ren <fantasquex@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2022-10-15 07:55:52 +02:00
..
accessibility tty: the rest, stop using tty_schedule_flip() 2022-07-29 17:19:28 +02:00
acpi ACPI: processor: Remove freq Qos request for all CPUs 2022-08-31 17:15:23 +02:00
amba amba: Make the remove callback return void 2022-04-08 14:40:02 +02:00
android binder: fix UAF of ref->proc caused by race condition 2022-09-08 11:11:38 +02:00
ata libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 2022-10-05 10:38:39 +02:00
atm atm: idt77252: fix use-after-free bugs caused by tst_timer 2022-08-25 11:38:02 +02:00
auxdisplay
…
base driver core: Don't probe devices after bus_type.match() probe deferral 2022-09-08 11:11:40 +02:00
bcma
…
block xen-blkfront: Cache feature_persistent value before advertisement 2022-09-15 11:32:02 +02:00
bluetooth Bluetooth: hci_intel: Add check for platform_driver_register 2022-08-21 15:15:49 +02:00
bus bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() 2022-08-21 15:15:35 +02:00
cdrom
…
char random: update comment from copy_to_user() -> copy_to_iter() 2022-06-29 08:59:54 +02:00
clk clk: iproc: Do not rely on node name for correct PLL setup 2022-10-05 10:38:43 +02:00
clocksource clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup() 2022-07-07 17:52:23 +02:00
connector
…
counter
…
cpufreq cpufreq: pmac32-cpufreq: Fix refcount leak bug 2022-07-21 21:20:14 +02:00
cpuidle
…
crypto crypto: hisilicon/sec - fix auth key size error 2022-08-21 15:15:50 +02:00
dax devdax: Fix soft-reservation memory description 2022-09-28 11:10:41 +02:00
dca
…
devfreq PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events 2022-07-07 17:52:18 +02:00
dio
…
dma dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure 2022-10-15 07:55:52 +02:00
dma-buf udmabuf: Set the DMA mask for the udmabuf device (v2) 2022-09-05 10:28:55 +02:00
edac EDAC/ghes: Set the DIMM label unconditionally 2022-08-03 12:00:50 +02:00
eisa
…
extcon extcon: Modify extcon device to be created after driver data is set 2022-06-14 18:32:43 +02:00
firewire firewire: core: extend card->lock in fw_core_handle_bus_reset 2022-05-12 12:25:32 +02:00
firmware firmware: arm_scmi: Add SCMI PM driver remove routine 2022-10-15 07:55:51 +02:00
fpga fpga: altera-pr-ip: fix unsigned comparison with less than zero 2022-08-21 15:15:53 +02:00
fsi fsi: Aspeed: Fix a potential double free 2022-04-08 14:40:23 +02:00
gnss
…
gpio gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully 2022-09-28 11:10:27 +02:00
gpu Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" 2022-10-05 10:38:41 +02:00
greybus
…
hid hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message 2022-09-20 12:38:31 +02:00
hsi
…
hv Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region 2022-09-28 11:10:39 +02:00
hwmon hwmon: (mr75203) enable polling for all VM channels 2022-09-15 11:32:06 +02:00
hwspinlock
…
hwtracing intel_th: pci: Add Raptor Lake-S CPU support 2022-08-21 15:16:17 +02:00
i2c i2c: mlxbf: Fix frequency calculation 2022-09-28 11:10:40 +02:00
i3c
…
ide
…
idle intel_idle: Disable IBRS during long idle 2022-07-25 11:26:43 +02:00
iio iio: adc: mcp3911: use correct formula for AD conversion 2022-09-08 11:11:37 +02:00
infiniband RDMA/mlx5: Set local port to one when accessing counters 2022-09-15 11:32:06 +02:00
input Input: melfas_mip4 - fix return value check in mip4_probe() 2022-10-05 10:38:41 +02:00
interconnect interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate 2022-09-28 11:10:28 +02:00
iommu iommu/vt-d: Check correct capability for sagaw determination 2022-09-28 11:10:26 +02:00
ipack
…
irqchip irqchip/tegra: Fix overflow implicit truncation warnings 2022-08-25 11:38:12 +02:00
isdn
…
leds
…
lightnvm lightnvm: disable the subsystem 2022-05-09 09:04:56 +02:00
macintosh macintosh/adb: fix oob read in do_adb_query() function 2022-08-11 13:06:47 +02:00
mailbox mailbox: forward the hrtimer if not queued and under a lock 2022-06-09 10:21:18 +02:00
mcb
…
md md: call __md_stop_writes in md_stop 2022-08-31 17:15:23 +02:00
media media: dvb_vb2: fix possible out of bound access 2022-10-05 10:38:40 +02:00
memory memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings 2022-06-29 08:59:54 +02:00
memstick memstick/ms_block: Fix a memory leak 2022-08-21 15:15:58 +02:00
message
…
mfd mfd: max77620: Fix refcount leak in max77620_initialise_fps 2022-08-21 15:16:09 +02:00
misc misc: fastrpc: fix memory corruption on open 2022-09-08 11:11:37 +02:00
mmc mmc: hsq: Fix data stomping during mmc recovery 2022-10-05 10:38:39 +02:00
most
…
mtd mtd: rawnand: arasan: Prevent an unsupported configuration 2022-08-21 15:16:26 +02:00
mux
…
net net: stmmac: power up/down serdes in stmmac_open/release 2022-10-05 10:38:42 +02:00
nfc nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout 2022-08-31 17:15:16 +02:00
ntb NTB: ntb_tool: uninitialized heap data in tool_fn_write() 2022-08-25 11:38:01 +02:00
nubus
…
nvdimm nvdimm: Fix badblocks clear off-by-one error 2022-07-07 17:52:15 +02:00
nvme nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices 2022-10-05 10:38:42 +02:00
nvmem
…
of of: fdt: fix off-by-one error in unflatten_dt_nodes() 2022-09-23 14:16:57 +02:00
opp opp: Fix error check in dev_pm_opp_attach_genpd() 2022-08-21 15:16:04 +02:00
oprofile
…
parisc parisc: ccio-dma: Add missing iounmap in error path in ccio_probe() 2022-09-23 14:16:58 +02:00
parport
…
pci Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()" 2022-09-05 10:28:55 +02:00
pcmcia pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards 2022-06-14 18:32:30 +02:00
perf perf/arm_pmu_platform: fix tests for platform_get_irq() failure 2022-09-20 12:38:32 +02:00
phy phy: qcom-qmp: fix pipe-clock imbalance on power-on failure 2022-06-14 18:32:32 +02:00
pinctrl pinctrl: sunxi: Fix name for A100 R_PIO 2022-09-23 14:16:57 +02:00
platform platform/x86/intel: hid: add quirk to support Surface Go 3 2022-09-23 14:16:56 +02:00
pnp
…
power power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe 2022-07-29 17:19:10 +02:00
powercap
…
pps
…
ps3
…
ptp ptp: replace snprintf with sysfs_emit 2022-04-13 21:00:55 +02:00
pwm pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource() 2022-08-21 15:15:37 +02:00
rapidio
…
ras
…
regulator regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() 2022-09-23 14:16:59 +02:00
remoteproc remoteproc: sysmon: Wait for SSCTL service to come up 2022-08-21 15:16:08 +02:00
reset reset: imx7: Fix the iMX8MP PCIe PHY PERST support 2022-10-05 10:38:40 +02:00
rpmsg rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge 2022-08-21 15:16:08 +02:00
rtc rtc: mt6397: check return value after calling platform_get_resource() 2022-06-14 18:32:33 +02:00
s390 s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup 2022-09-28 11:10:38 +02:00
sbus
…
scsi scsi: qedf: Fix a UAF bug in __qedf_probe() 2022-10-15 07:55:52 +02:00
sfi
…
sh
…
siox
…
slimbus slimbus: qcom: Fix IRQ check in qcom_slim_probe 2022-05-18 10:23:47 +02:00
soc soc: sunxi: sram: Fix debugfs info for A64 SRAM C 2022-10-05 10:38:41 +02:00
soundwire soundwire: bus_type: fix remove and shutdown support 2022-08-21 15:15:56 +02:00
spi spi: meson-spicc: add local pow2 clock ops to preserve rate between messages 2022-08-25 11:38:06 +02:00
spmi
…
ssb
…
staging media: rkvdec: Disable H.264 error detection 2022-10-05 10:38:40 +02:00
target target: remove an incorrect unmap zeroes data deduction 2022-06-09 10:21:01 +02:00
tc
…
tee tee: fix compiler warning in tee_shm_register() 2022-09-15 11:32:04 +02:00
thermal thermal: sysfs: Fix cooling_device_stats_setup() error code path 2022-08-21 15:15:22 +02:00
thunderbolt thunderbolt: Explicitly reset plug events delay back to USB4 spec value 2022-10-05 10:38:38 +02:00
tty serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting 2022-09-28 11:10:38 +02:00
uio
…
usb usb: typec: ucsi: Remove incorrect warning 2022-10-05 10:38:38 +02:00
vdpa vdpasim: allow to enable a vq repeatedly 2022-06-09 10:21:29 +02:00
vfio vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external() 2022-09-28 11:10:38 +02:00
vhost vringh: Fix loop descriptors check in the indirect cases 2022-06-14 18:32:45 +02:00
video video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write 2022-09-23 14:17:00 +02:00
virt vboxguest: Do not use devm for irq 2022-08-25 11:38:14 +02:00
virtio virtio_mmio: Restore guest page size on resume 2022-07-21 21:20:13 +02:00
visorbus
…
vlynq
…
vme
…
w1 w1: w1_therm: fixes w1_seq for ds28ea00 sensors 2022-04-13 21:01:01 +02:00
watchdog watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() 2022-08-21 15:16:10 +02:00
xen xen/grants: prevent integer overflow in gnttab_dma_alloc_pages() 2022-09-08 11:11:38 +02:00
zorro
…
Kconfig
…
Makefile
…