lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 332/530] scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
    Date
    From: Duoming Zhou <duoming@zju.edu.cn>

    [ Upstream commit 46ba53c30666717cb06c2b3c5d896301cd00d0c0 ]

    When executing SMP task failed, the smp_execute_task_sg() calls del_timer()
    to delete "slow_task->timer". However, if the timer handler
    sas_task_internal_timedout() is running, the del_timer() in
    smp_execute_task_sg() will not stop it and a UAF will happen. The process
    is shown below:

    (thread 1) | (thread 2)
    smp_execute_task_sg() | sas_task_internal_timedout()
    ... |
    del_timer() |
    ... | ...
    sas_free_task(task) |
    kfree(task->slow_task) //FREE|
    | task->slow_task->... //USE

    Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure
    the timer handler have finished before the "task->slow_task" is
    deallocated.

    Link: https://lore.kernel.org/r/20220920144213.10536-1-duoming@zju.edu.cn
    Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
    Reviewed-by: Jason Yan <yanaijie@huawei.com>
    Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/libsas/sas_expander.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
    index c2150a818423..9ae35631135d 100644
    --- a/drivers/scsi/libsas/sas_expander.c
    +++ b/drivers/scsi/libsas/sas_expander.c
    @@ -85,7 +85,7 @@ static int smp_execute_task_sg(struct domain_device *dev,
    res = i->dft->lldd_execute_task(task, GFP_KERNEL);

    if (res) {
    - del_timer(&task->slow_task->timer);
    + del_timer_sync(&task->slow_task->timer);
    pr_notice("executing SMP task failed:%d\n", res);
    break;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-24 16:09    [W:4.018 / U:0.632 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site