Skip to contentSkip to conversation

mtip32xx: Fix accessing freed memory

PATCH Applied Asai Thambi SP 2 participants 2 messages Jun 24, 2015 Block layer

lore
Share & tools
lore

Asai Thambi SP

author
#0 lore raw

PATCH 1/1 mtip32xx: Fix accessing freed memory

Quoted 1 line

From 4e5d695dca047012bc537c991fba0f85d112c614 Mon Sep 17 00:00:00 2001

From: Selvan Mani <[email protected]>
Date: Mon, 22 Jun 2015 02:18:48 -0700
Subject: [PATCH] mtip32xx: Fix accessing freed memory

In mtip_pci_remove(), driver data 'dd' is accessed after freeing it. This is a residue of SRSI code cleanup in the patch 016a41c38821 "mtip32xx: fix crash on surprise removal of the drive". Removed the bit flags MTIP_DDF_REMOVE_DONE_BIT and MTIP_PF_SR_CLEANUP_BIT.

Reported-by Julia Lawall <[email protected]>
Signed-off-by Vignesh Gunasekaran <[email protected]>
Signed-off-by Selvan Mani <[email protected]>
Signed-off-by Asai Thambi S P <[email protected]>
---
 drivers/block/mtip32xx/mtip32xx.c | 19 -------------------
 drivers/block/mtip32xx/mtip32xx.h |  2 --
 2 files changed, 21 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +0 -19
index 144e7d9..4a2ef09 100644
@@ -163,12 +163,6 @@ static bool mtip_check_surprise_removal(struct pci_dev *pdev)
 		else
 			dev_warn(&dd->pdev->dev,
 				"%s: dd->queue is NULL\n", __func__);
-		if (dd->port) {
-			set_bit(MTIP_PF_SR_CLEANUP_BIT, &dd->port->flags);
-			wake_up_interruptible(&dd->port->svc_wait);
-		} else
-			dev_warn(&dd->pdev->dev,
-				"%s: dd->port is NULL\n", __func__);
 		return true; /* device removed */
 	}
 

@@ -2938,10 +2932,6 @@ static int mtip_service_thread(void *data)
 			test_bit(MTIP_PF_SVC_THD_STOP_BIT, &port->flags))
 			goto st_out;
 
-		/* If I am an orphan, start self cleanup */
-		if (test_bit(MTIP_PF_SR_CLEANUP_BIT, &port->flags))
-			break;
-
 		if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
 				&dd->dd_flag)))
 			goto st_out;

@@ -2995,14 +2985,6 @@ restart_eh:
 		}
 	}
 
-	/* wait for pci remove to exit */
-	while (1) {
-		if (test_bit(MTIP_DDF_REMOVE_DONE_BIT, &dd->dd_flag))
-			break;
-		msleep_interruptible(1000);
-		if (kthread_should_stop())
-			goto st_out;
-	}
 st_out:
 	return 0;
 }

@@ -4486,7 +4468,6 @@ static void mtip_pci_remove(struct pci_dev *pdev)
 	spin_unlock_irqrestore(&dev_lock, flags);
 
 	kfree(dd);
-	set_bit(MTIP_DDF_REMOVE_DONE_BIT, &dd->dd_flag);
 
 	pcim_iounmap_regions(pdev, 1 << MTIP_ABAR);
 	pci_set_drvdata(pdev, NULL);
drivers/block/mtip32xx/mtip32xx.h +0 -2
index d7a5459..3274784 100644
@@ -142,7 +142,6 @@ enum {
 	MTIP_PF_SVC_THD_ACTIVE_BIT  = 4,
 	MTIP_PF_ISSUE_CMDS_BIT      = 5,
 	MTIP_PF_REBUILD_BIT         = 6,
-	MTIP_PF_SR_CLEANUP_BIT      = 7,
 	MTIP_PF_SVC_THD_STOP_BIT    = 8,
 
 	/* below are bit numbers in 'dd_flag' defined in driver_data */

@@ -150,7 +149,6 @@ enum {
 	MTIP_DDF_REMOVE_PENDING_BIT = 1,
 	MTIP_DDF_OVER_TEMP_BIT      = 2,
 	MTIP_DDF_WRITE_PROTECT_BIT  = 3,
-	MTIP_DDF_REMOVE_DONE_BIT    = 4,
 	MTIP_DDF_CLEANUP_BIT        = 5,
 	MTIP_DDF_RESUME_BIT         = 6,
 	MTIP_DDF_INIT_DONE_BIT      = 7,
Signature · 1 line
2.0.1.537.g81e776d
maintainer Applied
#1 lore raw
Quoted 9 lines · Asai Thambi SP

From 4e5d695dca047012bc537c991fba0f85d112c614 Mon Sep 17 00:00:00 2001
From: Selvan Mani <[email protected]>
Date: Mon, 22 Jun 2015 02:18:48 -0700
Subject: [PATCH] mtip32xx: Fix accessing freed memory

In mtip_pci_remove(), driver data 'dd' is accessed after freeing it. This is a residue of SRSI code cleanup in the patch 016a41c38821 "mtip32xx: fix crash on surprise removal of the drive". Removed the bit flags MTIP_DDF_REMOVE_DONE_BIT and MTIP_PF_SR_CLEANUP_BIT.

Thanks, applied.

Signature · 1 line
Jens Axboe