diff mbox series

[v3,06/18] scsi: ufs: Remove ufshcd_valid_tag()

Message ID 20210722033439.26550-7-bvanassche@acm.org
State New
Headers show
Series UFS patches for kernel v5.15 | expand

Commit Message

Bart Van Assche July 22, 2021, 3:34 a.m. UTC
scsi_add_host() allocates shost->can_queue tags. ufshcd_init() sets
shost->can_queue to hba->nutrs. In other words, we know that tag values
will less than hba->nutrs. Hence remove the checks that verify that
blk_get_request() returns a tag less than hba->nutrs. This check
was introduced by commit 14497328b6a6 ("scsi: ufs: verify command tag
validity").

Keep the tag >= 0 check because it helps to detect use-after-free issues.

Reviewed-by: Bean Huo <beanhuo@micron.com>
CC: Avri Altman <avri.altman@wdc.com>
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/scsi/ufs/ufshcd.c | 42 ++++++++++-----------------------------
 1 file changed, 10 insertions(+), 32 deletions(-)

Comments

Daejun Park July 28, 2021, 6:48 a.m. UTC | #1
Hi Bart,

> @@ -6979,24 +6966,15 @@ static int ufshcd_try_to_abort_task(struct ufs_hba *hba, int tag)

>   */

>  static int ufshcd_abort(struct scsi_cmnd *cmd)

>  {

> -        struct Scsi_Host *host;

> -        struct ufs_hba *hba;

> +        struct Scsi_Host *host = cmd->device->host;

> +        struct ufs_hba *hba = shost_priv(host);

> +        unsigned int tag = cmd->request->tag;

> +        struct ufshcd_lrb *lrbp = &hba->lrb[tag];


If tag < 0, lrbp will be assigned incorrect pointer.

>          unsigned long flags;

> -        unsigned int tag;

>          int err = 0;

> -        struct ufshcd_lrb *lrbp;

>          u32 reg;

>  

> -        host = cmd->device->host;

> -        hba = shost_priv(host);

> -        tag = cmd->request->tag;

> -        lrbp = &hba->lrb[tag];

> -        if (!ufshcd_valid_tag(hba, tag)) {

> -                dev_err(hba->dev,

> -                        "%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",

> -                        __func__, tag, cmd, cmd->request);

> -                BUG();

> -        }

> +        WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);

>  

>          ufshcd_hold(hba, false);

>          reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);


Thanks,
Daejun
Bart Van Assche July 28, 2021, 10:48 p.m. UTC | #2
On 7/27/21 11:48 PM, Daejun Park wrote:
>> @@ -6979,24 +6966,15 @@ static int ufshcd_try_to_abort_task(struct ufs_hba *hba, int tag)

>>    */

>>   static int ufshcd_abort(struct scsi_cmnd *cmd)

>>   {

>> -        struct Scsi_Host *host;

>> -        struct ufs_hba *hba;

>> +        struct Scsi_Host *host = cmd->device->host;

>> +        struct ufs_hba *hba = shost_priv(host);

>> +        unsigned int tag = cmd->request->tag;

>> +        struct ufshcd_lrb *lrbp = &hba->lrb[tag];

> 

> If tag < 0, lrbp will be assigned incorrect pointer.


That shouldn't hurt since lrbp is only used after it has been verified 
that tag >= 0.

Thanks,

Bart.
Daejun Park July 29, 2021, 12:26 a.m. UTC | #3
Hi Bart,

>On 7/27/21 11:48 PM, Daejun Park wrote:

>>> @@ -6979,24 +6966,15 @@ static int ufshcd_try_to_abort_task(struct ufs_hba *hba, int tag)

>>>    */

>>>   static int ufshcd_abort(struct scsi_cmnd *cmd)

>>>   {

>>> -        struct Scsi_Host *host;

>>> -        struct ufs_hba *hba;

>>> +        struct Scsi_Host *host = cmd->device->host;

>>> +        struct ufs_hba *hba = shost_priv(host);

>>> +        unsigned int tag = cmd->request->tag;

>>> +        struct ufshcd_lrb *lrbp = &hba->lrb[tag];

>> 

>> If tag < 0, lrbp will be assigned incorrect pointer.

> 

>That shouldn't hurt since lrbp is only used after it has been verified 

>that tag >= 0.

OK, I got it.

Reviewed-by: Daejun Park <daejun7.park@samsung.com>

> 

>Thanks,

> 

>Bart.

> 

> 

>
diff mbox series

Patch

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 17afd1b0bd2c..ec12cd4eae03 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -252,11 +252,6 @@  static inline void ufshcd_wb_toggle_flush(struct ufs_hba *hba, bool enable);
 static void ufshcd_hba_vreg_set_lpm(struct ufs_hba *hba);
 static void ufshcd_hba_vreg_set_hpm(struct ufs_hba *hba);
 
-static inline bool ufshcd_valid_tag(struct ufs_hba *hba, int tag)
-{
-	return tag >= 0 && tag < hba->nutrs;
-}
-
 static inline void ufshcd_enable_irq(struct ufs_hba *hba)
 {
 	if (!hba->is_irq_enabled) {
@@ -2700,20 +2695,12 @@  static void ufshcd_init_lrb(struct ufs_hba *hba, struct ufshcd_lrb *lrb, int i)
  */
 static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
 {
+	struct ufs_hba *hba = shost_priv(host);
+	int tag = cmd->request->tag;
 	struct ufshcd_lrb *lrbp;
-	struct ufs_hba *hba;
-	int tag;
 	int err = 0;
 
-	hba = shost_priv(host);
-
-	tag = cmd->request->tag;
-	if (!ufshcd_valid_tag(hba, tag)) {
-		dev_err(hba->dev,
-			"%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",
-			__func__, tag, cmd, cmd->request);
-		BUG();
-	}
+	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 
 	if (!down_read_trylock(&hba->clk_scaling_lock))
 		return SCSI_MLQUEUE_HOST_BUSY;
@@ -2967,7 +2954,7 @@  static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
 		goto out_unlock;
 	}
 	tag = req->tag;
-	WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag));
+	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 	/* Set the timeout such that the SCSI error handler is not activated. */
 	req->timeout = msecs_to_jiffies(2 * timeout);
 	blk_mq_start_request(req);
@@ -6677,7 +6664,7 @@  static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba,
 		goto out_unlock;
 	}
 	tag = req->tag;
-	WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag));
+	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 
 	if (unlikely(test_bit(tag, &hba->outstanding_reqs))) {
 		err = -EBUSY;
@@ -6979,24 +6966,15 @@  static int ufshcd_try_to_abort_task(struct ufs_hba *hba, int tag)
  */
 static int ufshcd_abort(struct scsi_cmnd *cmd)
 {
-	struct Scsi_Host *host;
-	struct ufs_hba *hba;
+	struct Scsi_Host *host = cmd->device->host;
+	struct ufs_hba *hba = shost_priv(host);
+	unsigned int tag = cmd->request->tag;
+	struct ufshcd_lrb *lrbp = &hba->lrb[tag];
 	unsigned long flags;
-	unsigned int tag;
 	int err = 0;
-	struct ufshcd_lrb *lrbp;
 	u32 reg;
 
-	host = cmd->device->host;
-	hba = shost_priv(host);
-	tag = cmd->request->tag;
-	lrbp = &hba->lrb[tag];
-	if (!ufshcd_valid_tag(hba, tag)) {
-		dev_err(hba->dev,
-			"%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",
-			__func__, tag, cmd, cmd->request);
-		BUG();
-	}
+	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 
 	ufshcd_hold(hba, false);
 	reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);