[PATCH] firewire: fw-sbp2: fix NULL pointer deref in slave_alloc

[PATCH] firewire: fw-sbp2: fix NULL pointer deref in slave_alloc

[Stefan Richter]

Fix a kernel bug when running rescan-scsi-bus while a FireWire disk is
connected:  http://bugzilla.kernel.org/show_bug.cgi?id=10008

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
---
 drivers/firewire/fw-sbp2.c |    4 ++++
 1 file changed, 4 insertions(+)

Index: linux/drivers/firewire/fw-sbp2.c
===================================================================
--- linux.orig/drivers/firewire/fw-sbp2.c
+++ linux/drivers/firewire/fw-sbp2.c
@@ -1473,6 +1473,10 @@ static int sbp2_scsi_slave_alloc(struct 
 {
 	struct sbp2_logical_unit *lu = sdev->hostdata;
 
+	/* (Re-)Adding logical units via the SCSI stack is not supported. */
+	if (!lu)
+		return -ENOSYS;
+
 	sdev->allow_restart = 1;
 
 	/*

-- 
Stefan Richter
-=====-==--- --=- =---=
http://arcgraph.de/sr/

[PATCH] ieee1394: sbp2: fix rescan-scsi-bus

[Stefan Richter]

rescan-scsi-bus used to add SBP-2 targets which weren't there.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
---
 drivers/ieee1394/sbp2.c |    3 +++
 1 file changed, 3 insertions(+)

Index: linux/drivers/ieee1394/sbp2.c
===================================================================
--- linux.orig/drivers/ieee1394/sbp2.c
+++ linux/drivers/ieee1394/sbp2.c
@@ -1974,6 +1974,9 @@ static int sbp2scsi_slave_alloc(struct s
 {
 	struct sbp2_lu *lu = (struct sbp2_lu *)sdev->host->hostdata[0];
 
+	if (sdev->lun != 0 || sdev->id != lu->ud->id || sdev->channel != 0)
+		return -ENODEV;
+
 	lu->sdev = sdev;
 	sdev->allow_restart = 1;
 

-- 
Stefan Richter
-=====-==--- --=- =---=
http://arcgraph.de/sr/

Re: [PATCH] ieee1394: sbp2: fix rescan-scsi-bus

[James Bottomley]

On Sun, 2008-02-17 at 14:57 +0100, Stefan Richter wrote:
> rescan-scsi-bus used to add SBP-2 targets which weren't there.
> 
> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
> ---
>  drivers/ieee1394/sbp2.c |    3 +++
>  1 file changed, 3 insertions(+)
> 
> Index: linux/drivers/ieee1394/sbp2.c
> ===================================================================
> --- linux.orig/drivers/ieee1394/sbp2.c
> +++ linux/drivers/ieee1394/sbp2.c
> @@ -1974,6 +1974,9 @@ static int sbp2scsi_slave_alloc(struct s
>  {
>  	struct sbp2_lu *lu = (struct sbp2_lu *)sdev->host->hostdata[0];
>  
> +	if (sdev->lun != 0 || sdev->id != lu->ud->id || sdev->channel != 0)
> +		return -ENODEV;
> +

It's hard to know what to say about this.  The infrastructure for
scanning did move to separate scanned (old parallel and a few other)
busses from hotplug ones (which is what sbp2 is).  You really need to
look at the scan_finished and user_scan callbacks.  Unfortunately the
latter is a transport class function and how all the modern busses (FC,
SAS and the like do this).

James

Re: [PATCH] firewire: fw-sbp2: fix NULL pointer deref in slave_alloc

[Stefan Richter]

On 17 Feb, Stefan Richter wrote:
> Fix a kernel bug when running rescan-scsi-bus while a FireWire disk is
> connected:  http://bugzilla.kernel.org/show_bug.cgi?id=10008
> 
> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
> ---
>  drivers/firewire/fw-sbp2.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 
> Index: linux/drivers/firewire/fw-sbp2.c
> ===================================================================
> --- linux.orig/drivers/firewire/fw-sbp2.c
> +++ linux/drivers/firewire/fw-sbp2.c
> @@ -1473,6 +1473,10 @@ static int sbp2_scsi_slave_alloc(struct 
>  {
>  	struct sbp2_logical_unit *lu = sdev->hostdata;
>  
> +	/* (Re-)Adding logical units via the SCSI stack is not supported. */
> +	if (!lu)
> +		return -ENOSYS;
> +
>  	sdev->allow_restart = 1;
>  
>  	/*
> 


There is unfortunately another bug.  If the user manually removes the
scsi_device by writing into its "delete" sysfs attribute, the following
will happen when the SBP-2 device is plugged out:


BUG: unable to handle kernel NULL pointer dereference at 00000000000000b8
IP: [<ffffffff804188c6>] mutex_lock_nested+0x7b/0x270
PGD 0 
Oops: 0002 [1] PREEMPT SMP 
CPU 0 
Modules linked in: firewire_sbp2 firewire_ohci firewire_core crc_itu_t i915 drm cpufreq_ondemand acpi_cpufreq freq_table applesmc input_polldev led_class coretemp hwmon eeprom snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss snd_hda_intel snd_pcm snd_timer snd snd_page_alloc button sg thermal processor sky2 i2c_i801 rtc [last unloaded: ieee1394]
Pid: 9, comm: events/0 Not tainted 2.6.25-rc2 #3
RIP: 0010:[<ffffffff804188c6>]  [<ffffffff804188c6>] mutex_lock_nested+0x7b/0x270
RSP: 0018:ffff81007dcddca0  EFLAGS: 00010002
RAX: 0000000000000100 RBX: ffff81007cc4a800 RCX: ffff81007009b000
RDX: ffff81007dc95040 RSI: 00000000000000d1 RDI: ffffffff804d0fcd
RBP: 00000000000000b0 R08: ffffffff805b5000 R09: ffffffff805b6000
R10: 00000000000000b0 R11: 0000000000000046 R12: 0000000000000246
R13: ffff81007dc95040 R14: ffffffff8036a670 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffffffff8055a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00000000000000b8 CR3: 0000000000201000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process events/0 (pid: 9, threadinfo ffff81007dcdc000, task ffff81007dc95040)
Stack:  ffff81007009b000 ffff81007009b078 0000000000000286 ffffffff8041a305
 0000000000000000 0000000000000000 ffff81007009b000 ffff81007cc4a800
 ffff81007009b638 00000000000000b0 ffff81007009b648 ffff81007009b000
Call Trace:
 [<ffffffff8041a305>] ? _spin_unlock_irqrestore+0x49/0x68
 [<ffffffff8036a670>] ? scsi_remove_device+0x1e/0x33
 [<ffffffff880ef799>] ? :firewire_sbp2:sbp2_release_target+0x33/0xca
 [<ffffffff880ef766>] ? :firewire_sbp2:sbp2_release_target+0x0/0xca
 [<ffffffff802ec6df>] ? kref_put+0x41/0x4c
 [<ffffffff880ef117>] ? :firewire_sbp2:sbp2_remove+0x10/0x14
 [<ffffffff8034d75c>] ? __device_release_driver+0x78/0x9e
 [<ffffffff8034db94>] ? device_release_driver+0x3d/0x55
 [<ffffffff8034cfd0>] ? bus_remove_device+0x76/0x85
 [<ffffffff8034b760>] ? device_del+0x114/0x181
 [<ffffffff88079095>] ? :firewire_core:shutdown_unit+0x0/0xd
 [<ffffffff8034b7d6>] ? device_unregister+0x9/0x12
 [<ffffffff8807909e>] ? :firewire_core:shutdown_unit+0x9/0xd
 [<ffffffff8041a2f9>] ? _spin_unlock_irqrestore+0x3d/0x68
 [<ffffffff8034b361>] ? device_for_each_child+0x22/0x4d
 [<ffffffff880790fc>] ? :firewire_core:fw_device_shutdown+0x2e/0x71
 [<ffffffff880790ce>] ? :firewire_core:fw_device_shutdown+0x0/0x71
 [<ffffffff8023b396>] ? run_workqueue+0xdf/0x1df
 [<ffffffff8023be87>] ? worker_thread+0xd8/0xe3
 [<ffffffff8023e917>] ? autoremove_wake_function+0x0/0x2e
 [<ffffffff8023bdaf>] ? worker_thread+0x0/0xe3
 [<ffffffff8023e813>] ? kthread+0x47/0x74
 [<ffffffff804198e0>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff8020c008>] ? child_rip+0xa/0x12
 [<ffffffff8020b6e3>] ? restore_args+0x0/0x3d
 [<ffffffff8023e68a>] ? kthreadd+0x14c/0x171
 [<ffffffff8023e68a>] ? kthreadd+0x14c/0x171
 [<ffffffff8023e7cc>] ? kthread+0x0/0x74
 [<ffffffff8020bffe>] ? child_rip+0x0/0x12


Code: c0 74 1a 83 3d 43 8a 55 00 00 75 11 be 86 00 00 00 48 c7 c7 cd 0f 4d 80 e8 40 3c e1 ff 9c 41 5c fa e8 f8 e9 e2 ff b8 00 01 00 00 <f0> 66 0f c1 45 08 38 e0 74 07 f3 90 8a 45 08 eb f5 48 39 6d 58 
RIP  [<ffffffff804188c6>] mutex_lock_nested+0x7b/0x270
 RSP <ffff81007dcddca0>
CR2: 00000000000000b8
---[ end trace 2a9c61e9883e29d2 ]---

-- 
Stefan Richter
-=====-==--- --=- =---=
http://arcgraph.de/sr/

Re: [PATCH] ieee1394: sbp2: fix rescan-scsi-bus

[Stefan Richter]

James Bottomley wrote:
> On Sun, 2008-02-17 at 14:57 +0100, Stefan Richter wrote:
>> rescan-scsi-bus used to add SBP-2 targets which weren't there.
...
>> +++ linux/drivers/ieee1394/sbp2.c
>> @@ -1974,6 +1974,9 @@ static int sbp2scsi_slave_alloc(struct s
>>  {
>>  	struct sbp2_lu *lu = (struct sbp2_lu *)sdev->host->hostdata[0];
>>  
>> +	if (sdev->lun != 0 || sdev->id != lu->ud->id || sdev->channel != 0)
>> +		return -ENODEV;
>> +
> 
> It's hard to know what to say about this.  The infrastructure for
> scanning did move to separate scanned (old parallel and a few other)
> busses from hotplug ones (which is what sbp2 is).  You really need to
> look at the scan_finished and user_scan callbacks.  Unfortunately the
> latter is a transport class function and how all the modern busses (FC,
> SAS and the like do this).

We add SBP-2 devices when they are detected on the FireWire bus.

The status with sbp2 (after the patch) is:
  - sbp2 calls scsi_add_device and scsi_remove_device when an SBP-2
    logical unit comes and goes away.
  - In between those, the user may call scsi_remove_device and
    optionally scsi_add_device via SCSI core's userspace interfaces
    and will get the device removed and re-added, respectively.
However, the latter is an utter useless pastime.  And so would be
scsi_transport_template.user_scan().

Implementing scsi_host_template.scan_finished() is logged to be done as
a possible feature addition.  It has ultra-low priority on my to-do list
though because the drivers have only little more knowledge than
userspace has about when all existing devices at a point in time might
have been discovered.
-- 
Stefan Richter
-=====-==--- --=- =---=
http://arcgraph.de/sr/

[PATCH] firewire: fw-sbp2: fix NULL pointer deref in scsi_remove_device

[Stefan Richter]

I wrote:
> There is unfortunately another bug.  If the user manually removes the
> scsi_device by writing into its "delete" sysfs attribute, the following
> will happen when the SBP-2 device is plugged out:
> 
> BUG: unable to handle kernel NULL pointer dereference at 00000000000000b8
> IP: [<ffffffff804188c6>] mutex_lock_nested+0x7b/0x270
...
> Call Trace:
>  [<ffffffff8041a305>] ? _spin_unlock_irqrestore+0x49/0x68
>  [<ffffffff8036a670>] ? scsi_remove_device+0x1e/0x33
>  [<ffffffff880ef799>] ? :firewire_sbp2:sbp2_release_target+0x33/0xca
>  [<ffffffff880ef766>] ? :firewire_sbp2:sbp2_release_target+0x0/0xca
>  [<ffffffff802ec6df>] ? kref_put+0x41/0x4c
>  [<ffffffff880ef117>] ? :firewire_sbp2:sbp2_remove+0x10/0x14
...
> ---[ end trace 2a9c61e9883e29d2 ]---
> 

Fix a kernel bug when unplugging an SBP-2 device after having its
scsi_device already removed via the "delete" sysfs attribute.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
---
 drivers/firewire/fw-sbp2.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

Index: linux-2.6.25-rc2/drivers/firewire/fw-sbp2.c
===================================================================
--- linux-2.6.25-rc2.orig/drivers/firewire/fw-sbp2.c
+++ linux-2.6.25-rc2/drivers/firewire/fw-sbp2.c
@@ -762,9 +762,10 @@ static void sbp2_release_target(struct k
 	sbp2_unblock(tgt);
 
 	list_for_each_entry_safe(lu, next, &tgt->lu_list, link) {
-		if (lu->sdev)
+		if (lu->sdev) {
 			scsi_remove_device(lu->sdev);
-
+			scsi_device_put(lu->sdev);
+		}
 		sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
 				SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
 
@@ -886,8 +887,6 @@ static void sbp2_login(struct work_struc
 	if (IS_ERR(sdev))
 		goto out_logout_login;
 
-	scsi_device_put(sdev);
-
 	/* Unreported error during __scsi_add_device() */
 	smp_rmb(); /* get current card generation */
 	if (generation != device->card->generation) {

-- 
Stefan Richter
-=====-==--- --=- =---=
http://arcgraph.de/sr/

Re: [PATCH] ieee1394: sbp2: fix rescan-scsi-bus

[Stefan Richter]

>> On Sun, 2008-02-17 at 14:57 +0100, Stefan Richter wrote:
>>> rescan-scsi-bus used to add SBP-2 targets which weren't there.

PS:  It probably wasn't clear:  rescan-scsi-bus.sh is *not* necessary
for sbp2 (under Linux 2.6, that is).  The patch merely prevents weird
things from happening if the user runs rescan-scsi-bus.sh on a 2.6 box
with sbp2 driven shosts present.
-- 
Stefan Richter
-=====-==--- --=- =---=
http://arcgraph.de/sr/

[PATCH update] firewire: fw-sbp2: fix NULL pointer deref in scsi_remove_device

[Stefan Richter]

Fix a kernel bug when unplugging an SBP-2 device after having its
scsi_device already removed via the "delete" sysfs attribute.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
---

Update:  A _put was missing in a failure path.

 drivers/firewire/fw-sbp2.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

Index: linux/drivers/firewire/fw-sbp2.c
===================================================================
--- linux.orig/drivers/firewire/fw-sbp2.c
+++ linux/drivers/firewire/fw-sbp2.c
@@ -762,9 +762,10 @@ static void sbp2_release_target(struct k
 	sbp2_unblock(tgt);
 
 	list_for_each_entry_safe(lu, next, &tgt->lu_list, link) {
-		if (lu->sdev)
+		if (lu->sdev) {
 			scsi_remove_device(lu->sdev);
-
+			scsi_device_put(lu->sdev);
+		}
 		sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
 				SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
 
@@ -886,12 +887,11 @@ static void sbp2_login(struct work_struc
 	if (IS_ERR(sdev))
 		goto out_logout_login;
 
-	scsi_device_put(sdev);
-
 	/* Unreported error during __scsi_add_device() */
 	smp_rmb(); /* get current card generation */
 	if (generation != device->card->generation) {
 		scsi_remove_device(sdev);
+		scsi_device_put(sdev);
 		goto out_logout_login;
 	}
 

-- 
Stefan Richter
-=====-==--- --=- =--==
http://arcgraph.de/sr/