John Garry d9d93f3253 scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task ... [ Upstream commit df7abcaa12 ] Currently a use-after-free may occur if a sas_task is aborted by the upper layer before we handle the I/O completion in mpi_ssp_completion() or mpi_sata_completion(). In this case, the following are the two steps in handling those I/O completions: - Call complete() to inform the upper layer handler of completion of the I/O. - Release driver resources associated with the sas_task in pm8001_ccb_task_free() call. When complete() is called, the upper layer may free the sas_task. As such, we should not touch the associated sas_task afterwards, but we do so in the pm8001_ccb_task_free() call. Fix by swapping the complete() and pm8001_ccb_task_free() calls ordering. Link: https://lore.kernel.org/r/1643289172-165636-4-git-send-email-john.garry@huawei.com Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> Acked-by: Jack Wang <jinpu.wang@ionos.com> Signed-off-by: John Garry <john.garry@huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-02-23 12:03:06 +01:00
..
Makefile
pm80xx_hwi.c	scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task	2022-02-23 12:03:06 +01:00
pm80xx_hwi.h	scsi: pm8001: Fix bogus FW crash for maxcpus=1	2022-02-16 12:56:13 +01:00
pm8001_chips.h
pm8001_ctl.c	scsi: pm8001: Clean up kernel-doc and comments	2021-07-12 21:54:07 -04:00
pm8001_ctl.h	scsi: pm8001: Clean up white space	2021-04-12 23:21:26 -04:00
pm8001_defs.h	scsi: pm80xx: Increase the number of outstanding I/O supported to 1024	2020-10-07 23:50:04 -04:00
pm8001_hwi.c	scsi: pm80xx: Fix double completion for SATA devices	2022-02-23 12:03:06 +01:00
pm8001_hwi.h	scsi: pm80xx: Completing pending I/O after fatal error	2021-04-15 22:28:59 -04:00
pm8001_init.c	scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()	2021-12-14 10:57:16 +01:00
pm8001_sas.c	scsi: pm8001: Fix use-after-free for aborted TMF sas_task	2022-02-23 12:03:06 +01:00
pm8001_sas.h	scsi: pm80xx: Fix memory leak during rmmod	2021-11-25 09:48:24 +01:00