Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <6301e87f-15f6-4c1f-41f5-d2f1aa4eedd7@huawei.com>
Date:   Tue, 19 Apr 2022 22:28:07 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.8.0
Content-Language: en-US
From:   Wenchao Hao <haowenchao@huawei.com>
Subject: [Question] SCSI_EH: How does EH guarantee there is no UAF of
 scsi_cmnd if host reset failed
To:     Hannes Reinecke <hare@suse.de>,
        "James E.J. Bottomley" <jejb@linux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        <linux-scsi@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
CC:     Feilong Lin <linfeilong@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi all, I am wondered how does SCSI EH guarantee there is no UAF of scsi_cmnd
if host reset failed. If host reset failed and eh_cmd_q of shost is not empty,
these command in eh_cmd_q would be added to done_q in scsi_eh_offline_sdevs()
and finished by scsi_eh_flush_done_q(). So these scsi_cmnd and it's related
request would be freed.

While since host reset failed, we can not guarantee the LLDDs has cleared all
references to these commands in eh_cmd_q. Is there any possibility that the
LLDDs reference to these commands? If this happened, then a using after free
issue would occur.

Waiting for your response.