Received: by 2002:ac0:a5a6:0:0:0:0:0 with SMTP id m35-v6csp227038imm; Tue, 18 Sep 2018 20:33:37 -0700 (PDT) X-Google-Smtp-Source: ANB0VdZSYB3rXyyx3qog9dJOTwk2HVDF7NiN8pJ8WMQjC9iXqG2usEEn5hFB4zuYqrDcQP9Rqroy X-Received: by 2002:a65:6104:: with SMTP id z4-v6mr4102535pgu.361.1537328017695; Tue, 18 Sep 2018 20:33:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1537328017; cv=none; d=google.com; s=arc-20160816; b=Naqj/CqxauabgIKXe3ryxfKGStZbGK7kEWNH9vrm2dkmkpjJhqf1J9V0Ja/Lc9NZeL 4ySsMWAOvmgCgx87Wf4GnblTu47N6ImVmubSTKMD44DTSLepNn0sUQVzs+s1clNMtiSH Kw1qt20WF3huqSqMEPmR1utiYwbvYtKRFU4g9o5BzfyPDkDk5FBkj4GXY7eajigj774B AFlem9bF+8Pf4h6+23khRKf1jj1c1NlNZiE0/97mnbULQy53sP2J/jwAhQhlT506Pgk0 aq/ctWqahP0cJ3tBPBnBwg4kfc5qajbSQWLyMS/aaR9h7BkWAc1QPcqnrFvOI6c8mX3A /EZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from; bh=5ibgoZ8FYCzQj6wC5PgAkO+h1FCMB1at9kF0k/vHbqw=; b=aveTOFA3UB9BnZ6UciwCf6ZnPnLFoNEK1wFGwEDw+ZczylOJXNEO4FOI+KeaZ9WDT5 sRaT6cucsv6bIk7GT3opt9XTprHZnEkct8bZ92xRF4+krlgllGg3UZJnKAmt0mti7pMR Y6usFc7Kk6AJ8YF6AmKuoiVS1nn5s9v2Frh6hsgNNDHRp0Xu/D9DPTjCsA/+U1us9kqg SeOn7Sv4jYgqQjHMpGAmcZStZ4esCjBwo6yc3f1YGmc52tkJrQE8DRj5GEEhO9hrmXNU O1AqL3b4M4XioDx307pcbdSYdnVMBQtXsHtG78T3x4AaoEWmSrqfQN9DaB+8m4rsQNTv 7Mvw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id g16-v6si19943056pgj.35.2018.09.18.20.33.22; Tue, 18 Sep 2018 20:33:37 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730776AbeISJIx (ORCPT + 99 others); Wed, 19 Sep 2018 05:08:53 -0400 Received: from szxga05-in.huawei.com ([45.249.212.191]:12184 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1730706AbeISJIx (ORCPT ); Wed, 19 Sep 2018 05:08:53 -0400 Received: from DGGEMS414-HUB.china.huawei.com (unknown [172.30.72.59]) by Forcepoint Email with ESMTP id 0A46EDEDC326A; Wed, 19 Sep 2018 11:33:00 +0800 (CST) Received: from huawei.com (10.175.124.28) by DGGEMS414-HUB.china.huawei.com (10.3.19.214) with Microsoft SMTP Server id 14.3.399.0; Wed, 19 Sep 2018 11:32:52 +0800 From: Jason Yan To: , CC: , , , , , , , , , , , Jason Yan , Ewan Milne , Tomas Henzl Subject: [PATCH v2 5/5] scsi: libsas: fix a race condition when smp task timeout Date: Wed, 19 Sep 2018 11:32:04 +0800 Message-ID: <20180919033204.11102-6-yanaijie@huawei.com> X-Mailer: git-send-email 2.14.4 In-Reply-To: <20180919033204.11102-1-yanaijie@huawei.com> References: <20180919033204.11102-1-yanaijie@huawei.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.124.28] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When the lldd is processing the complete sas task in interrupt and set the task stat as SAS_TASK_STATE_DONE, the smp timeout timer is able to be triggered at the same time. And smp_task_timedout() will complete the task wheter the SAS_TASK_STATE_DONE is set or not. Then the sas task may freed before lldd end the interrupt process. Thus a use-after-free will happen. Fix this by calling the complete() only when SAS_TASK_STATE_DONE is not set. And remove the check of the return value of the del_timer(). Once the LLDD sets DONE, it must call task->done(), which will call smp_task_done()->complete() and the task will be completed and freed correctly. Reported-by: chenxiang Signed-off-by: Jason Yan CC: John Garry CC: Johannes Thumshirn CC: Ewan Milne CC: Christoph Hellwig CC: Tomas Henzl CC: Dan Williams CC: Hannes Reinecke Reviewed-by: Hannes Reinecke --- drivers/scsi/libsas/sas_expander.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c index 52222940d398..0d1f72752ca2 100644 --- a/drivers/scsi/libsas/sas_expander.c +++ b/drivers/scsi/libsas/sas_expander.c @@ -48,17 +48,16 @@ static void smp_task_timedout(struct timer_list *t) unsigned long flags; spin_lock_irqsave(&task->task_state_lock, flags); - if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) + if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { task->task_state_flags |= SAS_TASK_STATE_ABORTED; + complete(&task->slow_task->completion); + } spin_unlock_irqrestore(&task->task_state_lock, flags); - - complete(&task->slow_task->completion); } static void smp_task_done(struct sas_task *task) { - if (!del_timer(&task->slow_task->timer)) - return; + del_timer(&task->slow_task->timer); complete(&task->slow_task->completion); } -- 2.14.4