Re: [PATCH] scsi: pm8001: Fix potential TOCTOU race in pm8001_find_tag

[Chengfeng Ye]

>  drivers/scsi/pm8001/pm8001_sas.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
> index 6a8d35aea93a..2d73e65db4c0 100644
> --- a/drivers/scsi/pm8001/pm8001_sas.c
> +++ b/drivers/scsi/pm8001/pm8001_sas.c
> @@ -49,9 +49,10 @@
>   */
>  static int pm8001_find_tag(struct sas_task *task, u32 *tag)
>  {
> -       if (task->lldd_task) {
> -               struct pm8001_ccb_info *ccb;
> -               ccb = task->lldd_task;
> +       struct pm8001_ccb_info *ccb;
> +
> +       ccb = READ_ONCE(task->lldd_task);
> +       if (ccb) {
>                 *tag = ccb->ccb_tag;
>                 return 1;
>         }
> @@ -617,7 +618,7 @@ void pm8001_ccb_task_free(struct pm8001_hba_info *pm8001_ha,
>                         pm8001_dev ? atomic_read(&pm8001_dev->running_req) : -1);
>         }
>
> -       task->lldd_task = NULL;
> +       WRITE_ONCE(task->lldd_task, NULL);
>         pm8001_ccb_free(pm8001_ha, ccb);
>  }
>
> --
> 2.25.1
>

> Fix this by using READ_ONCE() to read task->lldd_task exactly once,
> eliminating the TOCTOU window. Also use WRITE_ONCE() in
> pm8001_ccb_task_free() for proper memory ordering.

It just hit me that the patch can only eliminate the race on
task->lldd_task but cannot guarantee cbb has not released by
pm8001_ccb_free(pm8001_ha, ccb) when accssed. Maybe we still require a
lock synchronization?

Chengfeng