diff options
| author | yuuzheng <yuuzheng@google.com> | 2020-11-02 22:25:28 +0530 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2020-11-04 22:55:38 -0500 |
| commit | 1f889b58716a5f5e3e4fe0e6742c1a4472f29ac1 (patch) | |
| tree | 659be121684dc68dc04ab03c28308eb1ebe5c018 /tools/perf/scripts/python/bin/stackcollapse-report | |
| parent | 48cd6b38eb4f2874f091c4776ea1c26e7e4f967e (diff) | |
| download | linux-1f889b58716a5f5e3e4fe0e6742c1a4472f29ac1.tar.gz linux-1f889b58716a5f5e3e4fe0e6742c1a4472f29ac1.zip | |
scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition
A use-after-free or null-pointer error occurs when the 251-byte response
data is copied from IOMB buffer to response message buffer in function
pm8001_mpi_get_nvmd_resp().
After sending the command get_nvmd_data(), the caller begins to sleep by
calling wait_for_complete() and waits for the wake-up from calling
complete() in pm8001_mpi_get_nvmd_resp(). Due to unexpected events (e.g.,
interrupt), if response buffer gets freed before memcpy(), a use-after-free
error will occur. To fix this, the complete() should be called after
memcpy().
Link: https://lore.kernel.org/r/20201102165528.26510-5-Viswas.G@microchip.com.com
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: yuuzheng <yuuzheng@google.com>
Signed-off-by: Viswas G <Viswas.G@microchip.com>
Signed-off-by: Ruksar Devadi <Ruksar.devadi@microchip.com>
Signed-off-by: Radha Ramachandran <radha@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-report')
0 files changed, 0 insertions, 0 deletions