Bug 84091
| Summary: | Unloading qla2xxx kernel module triggers segmentation fault | ||
|---|---|---|---|
| Product: | SCSI Drivers | Reporter: | Bart Van Assche (bvanassche) |
| Component: | QLOGIC QLA2XXX | Assignee: | scsi_drivers-qla2xxx |
| Status: | NEW --- | ||
| Severity: | normal | CC: | joe.lawrence |
| Priority: | P1 | ||
| Hardware: | x86-64 | ||
| OS: | Linux | ||
| Kernel Version: | 3.16.1 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
Hi Bart, Does the following patch queued up in Christoph's tree fix the use-after-free? cf6dc619eb7c qla2xxx: Fix shost use-after-free on device removal http://git.infradead.org/users/hch/scsi-queue.git/commit/cf6dc619eb7cfadd9e44d384fb06672a157024ab Regards, -- Joe This issue doesn't occur anymore with that patch applied. Thanks ! |
After having upgraded the firmware of a QLE2562 adapter to version 07.03.00, trying to unload (rmmod) the QLogic initiator driver kernel module triggers a segmentation fault. This occurs at least with kernel versions 3.15.8 and 3.16.1 if memory poisoning has been enabled (CONFIG_SLUB_DEBUG_ON=y). From the system log: general protection fault: 0000 [#1] PREEMPT SMP Modules linked in: qla2xxx(-) scsi_transport_fc fuse ip6table_filter ip6_tables iptable_filter ip_tables ebtable_nat ebtables x_tables 8021q garp bridge stp llc rdma_ucm rdma_cm iw_cm af_packet ib_ipoib ib_cm ib_uverbs ib_umad mlx4_en mlx4_ib ib_sa ib_mad ib_core ib_addr snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic x86_pkg_temp_thermal kvm_intel kvm crc32c_intel microcode pcspkr sr_mod cdrom snd_hda_intel snd_hda_controller lpc_ich snd_hda_codec snd_hwdep i2c_i801 mfd_core snd_pcm snd_seq mlx4_core snd_seq_device snd_timer e1000e snd ptp soundcore pps_core wmi acpi_cpufreq button sg dm_mod autofs4 ext4 crc16 mbcache jbd2 xor lzo_compress raid6_pq sd_mod crc_t10dif crct10dif_common hid_generic usbhid hid radeon i2c_algo_bit drm_kms_helper ahci ttm libahci libata drm xhci_hcd ehci_pci agpgart ehci_hcd i2c_core usbcore usb_common processor thermal_sys hwmon scsi_dh_alua scsi_dh scsi_mod CPU: 4 PID: 4447 Comm: rmmod Not tainted 3.16.1-debug+ #1 Hardware name: MSI MS-7737/Big Bang-XPower II (MS-7737), BIOS V1.5 10/16/2012 task: ffff88082f900000 ti: ffff8807fbe80000 task.ti: ffff8807fbe80000 RIP: 0010:[<ffffffffa0831bcf>] [<ffffffffa0831bcf>] qla2x00_remove_one+0x11f/0x220 [qla2xxx] RSP: 0018:ffff8807fbe83e00 EFLAGS: 00010282 RAX: ffff88082f900001 RBX: 6b6b6b6b6b6b6b6b RCX: 0000000000000001 RDX: 0000000000000006 RSI: ffff88082f900828 RDI: ffff88082f900000 RBP: ffff8807fbe83e18 R08: ffff8807fd416930 R09: 0000000100180011 R10: 0000000000000000 R11: 0000000000000002 R12: ffff8807fe190000 R13: ffff880838c6a290 R14: ffffffffa08ac0e0 R15: 0000000000eaf010 FS: 00007fc26c717700(0000) GS:ffff88085fc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000002002470 CR3: 00000007fe218000 CR4: 00000000000407e0 Stack: ffff880838c6a328 ffff880838c6a290 ffff880838c6a388 ffff8807fbe83e38 ffffffff8129f79d ffff880838c6a328 ffffffffa08ac068 ffff8807fbe83e58 ffffffff8133ab09 ffff880838c6a328 ffffffffa08ac068 ffff8807fbe83e80 Call Trace: [<ffffffff8129f79d>] pci_device_remove+0x2d/0x60 [<ffffffff8133ab09>] __device_release_driver+0x69/0xd0 [<ffffffff8133b4d0>] driver_detach+0xc0/0xd0 [<ffffffff8133a7e8>] bus_remove_driver+0x58/0xd0 [<ffffffff8133b8dc>] driver_unregister+0x2c/0x50 [<ffffffff8129f6ca>] pci_unregister_driver+0x2a/0x80 [<ffffffffa0892b96>] qla2x00_module_exit+0x2c/0x9c [qla2xxx] [<ffffffff810d2452>] SyS_delete_module+0x142/0x1d0 [<ffffffff814c3c43>] ? tracesys+0x71/0xd5 [<ffffffff814c3ca2>] tracesys+0xd0/0xd5 Code: 00 48 8b 7b 68 e8 a2 3c fe ff 48 8b 7b 68 e8 29 12 7d ff 48 89 df e8 11 f1 ff ff 48 8b 7b 68 e8 38 16 7d ff 48 8b 9b d8 01 00 00 <8b> 83 58 01 00 00 a9 00 00 04 00 0f 85 cc 00 00 00 f6 c4 40 75 RIP [<ffffffffa0831bcf>] qla2x00_remove_one+0x11f/0x220 [qla2xxx] RSP <ffff8807fbe83e00> ---[ end trace f16db7305109991a ]--- gdb translates the crash address into the following: (gdb) list *(qla2x00_remove_one+0x11f) 0x5bcf is in qla2x00_remove_one (drivers/scsi/qla2xxx/qla_os.c:3118). 3113 static void 3114 qla2x00_clear_drv_active(scsi_qla_host_t *vha) 3115 { 3116 struct qla_hw_data *ha = vha->hw; 3117 3118 if (IS_QLA8044(ha)) { 3119 qla8044_idc_lock(ha); 3120 qla8044_clear_drv_active(ha); 3121 qla8044_idc_unlock(ha); 3122 } else if (IS_QLA82XX(ha)) { From the gdb "disassemble /m qla2x00_remove_one" output (0x11f = 287): 0x0000000000005bc8 <+280>: mov 0x1d8(%rbx),%rbx 0x0000000000005bcf <+287>: mov 0x158(%rbx),%eax 0x0000000000005bd5 <+293>: test $0x40000,%eax So it seems like qla2x00_clear_drv_active() is called with vha = 0x6b6b6b6b6b6b6b6b. I think this indicates a use-after-free.