Re: [PATCH] scsi: lpfc: Fix buffer free/clear order in deferred receive path

[John Evans]

> nvmebuf NULL ptr check is already performed earlier in this routine.
>
> Maybe this patch should rather look like:
>
> diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
> index fba2e62027b7..cd527324eae7 100644
> --- a/drivers/scsi/lpfc/lpfc_nvmet.c
> +++ b/drivers/scsi/lpfc/lpfc_nvmet.c
> @@ -1264,10 +1264,10 @@ lpfc_nvmet_defer_rcv(struct
> nvmet_fc_target_port *tgtport,
>                 atomic_inc(&tgtp->rcv_fcp_cmd_defer);
>
>         /* Free the nvmebuf since a new buffer already replaced it */
> -       nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
>         spin_lock_irqsave(&ctxp->ctxlock, iflag);
>         ctxp->rqb_buffer = NULL;
>         spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
> +       nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
>  }
>
> Regards,
> Justin Tee

Hi Justin,

Moving free() after clearing is necessary but not sufficient.

The race is between the load of ctxp->rqb_buffer and the clear under
ctxp->ctxlock. If we load nvmebuf without the lock, another path
can free+NULL it before we take the lock:

T1 (defer_rcv):   nvmebuf = ctxp->rqb_buffer;   // no lock
T2 (ctxbuf_post): [lock] nvmebuf' = ctxp->rqb_buffer; ctxp->rqb_buffer
= NULL; free(nvmebuf'); [unlock]
T1 (defer_rcv):   [lock] ctxp->rqb_buffer = NULL; [unlock];
free(nvmebuf);   // UAF/double free