Commit 59e8684b authored by Sreekanth Reddy's avatar Sreekanth Reddy Committed by Yu Liao
Browse files

scsi: mpt3sas: Fix kernel panic during drive powercycle test 

stable inclusion
from stable-v4.19.219
commit 0d4b29eaadc1f59cec0c7e85eae77d08fcca9824
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S1ZO
CVE: CVE-2021-47565

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=0d4b29eaadc1f59cec0c7e85eae77d08fcca9824

--------------------------------

[ Upstream commit 0ee4ba13 ]

While looping over shost's sdev list it is possible that one
of the drives is getting removed and its sas_target object is
freed but its sdev object remains intact.

Consequently, a kernel panic can occur while the driver is trying to access
the sas_address field of sas_target object without also checking the
sas_target object for NULL.

Link: https://lore.kernel.org/r/20211117104909.2069-1-sreekanth.reddy@broadcom.com


Fixes: f92363d1 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Signed-off-by: default avatarSreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYu Liao <liaoyu15@huawei.com>
parent d2901c3f

drivers/scsi/mpt3sas/mpt3sas_scsih.c

+1 −1
Original line number Diff line number Diff line
@@ -3364,7 +3364,7 @@ _scsih_ublock_io_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address) 


	shost_for_each_device(sdev, ioc->shost) {

		sas_device_priv_data = sdev->hostdata;

		if (!sas_device_priv_data)

		if (!sas_device_priv_data || !sas_device_priv_data->sas_target)

			continue;

		if (sas_device_priv_data->sas_target->sas_address

		    != sas_address)