Commit 6af1cb36 authored Nov 14, 2024 by Igor Pylypiv Committed by Zicheng Qu Nov 14, 2024

scsi: pm80xx: Set phy->enable_completion only when we wait for it

stable inclusion
from stable-v6.6.51
commit 7b1d779647afaea9185fa2f150b1721e7c1aae89
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU94
CVE: CVE-2024-47666

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7b1d779647afaea9185fa2f150b1721e7c1aae89



--------------------------------

[ Upstream commit e4f949ef1516c0d74745ee54a0f4882c1f6c7aea ]

pm8001_phy_control() populates the enable_completion pointer with a stack
address, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and
returns. The problem arises when a phy control response comes late.  After
300 ms the pm8001_phy_control() function returns and the passed
enable_completion stack address is no longer valid. Late phy control
response invokes complete() on a dangling enable_completion pointer which
leads to a kernel crash.

Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Terrence Adams <tadamsjr@google.com>
Link: https://lore.kernel.org/r/20240627155924.2361370-2-tadamsjr@google.com


Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Conflicts:
	drivers/scsi/pm8001/pm8001_sas.c
[The 5.10 stable version lacks this patch 7b1d779647afaea9185fa2f150b1721e7c1aae89, which was pulled from 6.6.
Missing commits a961ea0a and 4851c39a
in 5.10 led to manually removing the if (PM8001_CHIP_DISP->fatal_errors(pm8001_ha)) code.]
Signed-off-by: Zicheng Qu <quzicheng@huawei.com>

parent 2962d745

drivers/scsi/pm8001/pm8001_sas.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -163,7 +163,6 @@ int pm8001_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
		unsigned long flags;
		pm8001_ha = sas_phy->ha->lldd_ha;
		phy = &pm8001_ha->phy[phy_id];
		pm8001_ha->phy[phy_id].enable_completion = &completion;
		switch (func) {
		case PHY_FUNC_SET_LINK_RATE:
		rates = funcdata;
		@@ -176,6 +175,7 @@ int pm8001_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
		rates->maximum_linkrate;
		}
		if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
		pm8001_ha->phy[phy_id].enable_completion = &completion;
		PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
		wait_for_completion(&completion);
		}
		@@ -184,6 +184,7 @@ int pm8001_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
		break;
		case PHY_FUNC_HARD_RESET:
		if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
		pm8001_ha->phy[phy_id].enable_completion = &completion;
		PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
		wait_for_completion(&completion);
		}
		@@ -192,6 +193,7 @@ int pm8001_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
		break;
		case PHY_FUNC_LINK_RESET:
		if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
		pm8001_ha->phy[phy_id].enable_completion = &completion;
		PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
		wait_for_completion(&completion);
		}