Skip to content
  1. Nov 05, 2021
    • George Kennedy's avatar
      scsi: scsi_debug: Don't call kcalloc() if size arg is zero · 3344b58b
      George Kennedy authored
      
      
      If the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR.  Because of
      that, for a following NULL pointer check to work on the returned pointer,
      kcalloc() must not be called with the size arg equal to zero. Return early
      without error before the kcalloc() call if size arg is zero.
      
      BUG: KASAN: null-ptr-deref in memcpy include/linux/fortify-string.h:191 [inline]
      BUG: KASAN: null-ptr-deref in sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974
      Write of size 4 at addr 0000000000000010 by task syz-executor.1/22789
      
      CPU: 1 PID: 22789 Comm: syz-executor.1 Not tainted 5.15.0-syzk #1
      Hardware name: Red Hat KVM, BIOS 1.13.0-2
      Call Trace:
       __dump_stack lib/dump_stack.c:88 [inline]
       dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106
       __kasan_report mm/kasan/report.c:446 [inline]
       kasan_report.cold.14+0x112/0x117 mm/kasan/report.c:459
       check_region_inline mm/kasan/generic.c:183 [inline]
       kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189
       memcpy+0x3b/0x60 mm/kasan/shadow.c:66
       memcpy include/linux/fortify-string.h:191 [inline]
       sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974
       do_dout_fetch drivers/scsi/scsi_debug.c:2954 [inline]
       do_dout_fetch drivers/scsi/scsi_debug.c:2946 [inline]
       resp_verify+0x49e/0x930 drivers/scsi/scsi_debug.c:4276
       schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478
       scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533
       scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]
       scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699
       blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639
       __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325
       blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358
       __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761
       __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838
       blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891
       blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474
       blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62
       blk_execute_rq+0xdb/0x360 block/blk-exec.c:102
       sg_scsi_ioctl drivers/scsi/scsi_ioctl.c:621 [inline]
       scsi_ioctl+0x8bb/0x15c0 drivers/scsi/scsi_ioctl.c:930
       sg_ioctl_common+0x172d/0x2710 drivers/scsi/sg.c:1112
       sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:874 [inline]
       __se_sys_ioctl fs/ioctl.c:860 [inline]
       __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Link: https://lore.kernel.org/r/1636056397-13151-1-git-send-email-george.kennedy@oracle.com
      Reported-by: default avatarsyzkaller <syzkaller@googlegroups.com>
      Acked-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
      Signed-off-by: default avatarGeorge Kennedy <george.kennedy@oracle.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      3344b58b
    • Tadeusz Struk's avatar
      scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd() · 703535e6
      Tadeusz Struk authored
      No need to deduce command size in scsi_setup_scsi_cmnd() anymore as
      appropriate checks have been added to scsi_fill_sghdr_rq() function and the
      cmd_len should never be zero here.  The code to do that wasn't correct
      anyway, as it used uninitialized cmd->cmnd, which caused a null-ptr-deref
      if the command size was zero as in the trace below. Fix this by removing
      the unneeded code.
      
      KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
      CPU: 0 PID: 1822 Comm: repro Not tainted 5.15.0 #1
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014
      Call Trace:
       blk_mq_dispatch_rq_list+0x7c7/0x12d0
       __blk_mq_sched_dispatch_requests+0x244/0x380
       blk_mq_sched_dispatch_requests+0xf0/0x160
       __blk_mq_run_hw_queue+0xe8/0x160
       __blk_mq_delay_run_hw_queue+0x252/0x5d0
       blk_mq_run_hw_queue+0x1dd/0x3b0
       blk_mq_sched_insert_request+0x1ff/0x3e0
       blk_execute_rq_nowait+0x173/0x1e0
       blk_execute_rq+0x15c/0x540
       sg_io+0x97c/0x1370
       scsi_ioctl+0xe16/0x28e0
       sd_ioctl+0x134/0x170
       blkdev_ioctl+0x362/0x6e0
       block_ioctl+0xb0/0xf0
       vfs_ioctl+0xa7/0xf0
       do_syscall_64+0x3d/0xb0
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      ---[ end trace 8b086e334adef6d2 ]---
      Kernel panic - not syncing: Fatal exception
      
      Link: https://lore.kernel.org/r/20211103170659.22151-2-tadeusz.struk@linaro.org
      Fixes: 2ceda20f
      
       ("scsi: core: Move command size detection out of the fast path")
      Cc: Bart Van Assche <bvanassche@acm.org>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: James E.J. Bottomley <jejb@linux.ibm.com>
      Cc: Martin K. Petersen <martin.petersen@oracle.com>
      Cc: <linux-scsi@vger.kernel.org>
      Cc: <linux-kernel@vger.kernel.org>
      Cc: <stable@vger.kernel.org> # 5.15, 5.14, 5.10
      Reported-by: default avatar <syzbot+5516b30f5401d4dcbcae@syzkaller.appspotmail.com>
      Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarTadeusz Struk <tadeusz.struk@linaro.org>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      703535e6
  2. Nov 04, 2021
  3. Oct 30, 2021
    • Avri Altman's avatar
      scsi: ufs: ufshpb: Remove HPB2.0 flows · 09d9e4d0
      Avri Altman authored
      
      
      The Host Performance Buffer feature allows UFS read commands to carry the
      physical media addresses along with the LBAs, thus allowing less internal
      L2P-table switches in the device.  HPB1.0 allowed a single LBA, while
      HPB2.0 increases this capacity up to 255 blocks.
      
      Carrying more than a single record, the read operation is no longer purely
      of type "read" but a "hybrid" command: Writing the physical address to the
      device in one operation and reading back the required payload in another.
      
      The JEDEC HPB spec defines two commands for this operation:
      HPB-WRITE-BUFFER (0x2) to write the physical addresses to device, and
      HPB-READ to read the payload.
      
      With the current HPB design the UFS driver has no alternative but to divide
      the READ request into 2 separate commands: HPB-WRITE-BUFFER and HPB-READ.
      This causes a great deal of aggravation to the block layer guys who
      demanded that we completely revert the entire HPB driver regardless of the
      huge amount of corporate effort already invested in it.
      
      As a compromise, remove only the pieces that implement the 2.0
      specification. This is done as a matter of urgency for the final 5.15
      release.
      
      Link: https://lore.kernel.org/r/20211030062301.248-1-avri.altman@wdc.com
      Tested-by: default avatarAvri Altman <avri.altman@wdc.com>
      Tested-by: default avatarBean Huo <beanhuo@micron.com>
      Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
      Reviewed-by: default avatarBean Huo <beanhuo@micron.com>
      Co-developed-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
      Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
      Signed-off-by: default avatarAvri Altman <avri.altman@wdc.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      09d9e4d0
    • Martin K. Petersen's avatar
      scsi: mpt3sas: Fix reference tag handling for WRITE_INSERT · 61a9f252
      Martin K. Petersen authored
      Testing revealed a problem with how the reference tag was handled for
      a WRITE_INSERT operation. The SCSI_PROT_REF_CHECK flag is not set when
      the controller is asked to generate the protection information
      (i.e. not DIX). And as a result the initial reference tag would not be
      set in the WRITE_INSERT case.
      
      Separate handling of the REF_CHECK and REF_INCREMENT flags to align
      with both the DIX spec and the MPI implementation.
      
      Link: https://lore.kernel.org/r/20211028034202.24225-1-martin.petersen@oracle.com
      Fixes: b3e2c72a
      
       ("scsi: mpt3sas: Use the proper SCSI midlayer interfaces for PI")
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      61a9f252
  4. Oct 28, 2021
  5. Oct 27, 2021