mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-07 17:19:02 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/scsi/libsas
History
Duoming Zhou 46ba53c306 scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() 
When executing SMP task failed, the smp_execute_task_sg() calls del_timer()
to delete "slow_task->timer". However, if the timer handler
sas_task_internal_timedout() is running, the del_timer() in
smp_execute_task_sg() will not stop it and a UAF will happen. The process
is shown below:

      (thread 1)               |        (thread 2)
smp_execute_task_sg()          | sas_task_internal_timedout()
 ...                           |
 del_timer()                   |
 ...                           |  ...
 sas_free_task(task)           |
  kfree(task->slow_task) //FREE|
                               |  task->slow_task->... //USE

Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure
the timer handler have finished before the "task->slow_task" is
deallocated.

Link: https://lore.kernel.org/r/20220920144213.10536-1-duoming@zju.edu.cn
Fixes: 2908d778ab ("[SCSI] aic94xx: new driver")
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-25 12:56:07 -04:00
..
Kconfig scsi: libsas: Drop BLK_DEV_BSGLIB selection 2021-07-27 00:06:42 -04:00
Makefile scsi: libsas: Allow libsas to include SCSI header files directly 2021-07-20 23:11:17 -04:00
sas_ata.c scsi: libsas: Refactor sas_ata_hard_reset() 2022-05-19 20:16:25 -04:00
sas_discover.c scsi: libsas: Use void for sas_discover_event() return code 2022-02-11 17:13:29 -05:00
sas_event.c scsi: libsas: Use bool for queue_work() return code 2022-02-27 21:48:30 -05:00
sas_expander.c scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() 2022-09-25 12:56:07 -04:00
sas_host_smp.c scsi: libsas: Allow libsas to include SCSI header files directly 2021-07-20 23:11:17 -04:00
sas_init.c scsi: libsas: Resume SAS host for phy reset or enable via sysfs 2022-07-18 23:04:12 -04:00
sas_internal.h scsi: libsas: Introduce struct smp_rps_resp 2022-06-10 13:08:06 -04:00
sas_phy.c scsi: libsas: Allow libsas to include SCSI header files directly 2021-07-20 23:11:17 -04:00
sas_port.c scsi: libsas: Clean up sas_form_port() 2022-03-01 23:56:27 -05:00
sas_scsi_host.c scsi: hisi_sas: Use libsas internal abort support 2022-03-14 23:33:24 -04:00
sas_task.c scsi: libsas: Use enum for response frame DATAPRES field 2022-02-19 15:59:34 -05:00