linux-kernel - [PATCH] scsi: smartpqi: Fix use after free bug in pqi_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20230312164806.2104140-1-zyytlz.wz@163.com>
Date:   Mon, 13 Mar 2023 00:48:06 +0800
From:   Zheng Wang <zyytlz.wz@....com>
To:     don.brace@...rochip.com
Cc:     jejb@...ux.ibm.com, martin.petersen@...cle.com,
        storagedev@...rochip.com, linux-scsi@...r.kernel.org,
        linux-kernel@...r.kernel.org, hackerzheng666@...il.com,
        1395428693sheep@...il.com, alex000young@...il.com,
        Zheng Wang <zyytlz.wz@....com>
Subject: [PATCH] scsi: smartpqi: Fix use after free bug in pqi_pci_remove due to race condition

In pqi_pci_probe, it calls pqi_alloc_ctrl_info and bound
&ctrl_info->event_work with pqi_event_worker.

When it calls pqi_irq_handler to handle IRQ, 
it will finally call schedule_work to start the work.

When we call pqi_pci_remove to remove the driver, there
may be a sequence as follows:

Fix it by finishing the work before cleanup in pqi_remove_ctrl.

CPU0                  CPU1

                    |pqi_event_worker
pqi_pci_remove      |
  pqi_remove_ctrl   |
pqi_free_ctrl_resources|
pqi_free_ctrl_info|
     kfree(ctrl_info)  |
//free ctrl_info   |
                    |pqi_ctrl_busy
                    |//use ctrl_info

Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver")
Signed-off-by: Zheng Wang <zyytlz.wz@....com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 49a8f91810b6..555f1af38f38 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -8939,6 +8939,7 @@ static void pqi_take_ctrl_offline_deferred(struct pqi_ctrl_info *ctrl_info)
 	pqi_perform_lockup_action();
 	pqi_stop_heartbeat_timer(ctrl_info);
 	pqi_free_interrupts(ctrl_info);
+	cancel_work_sync(&ctrl_info->event_work);
 	pqi_cancel_rescan_worker(ctrl_info);
 	pqi_cancel_update_time_worker(ctrl_info);
 	pqi_ctrl_wait_until_quiesced(ctrl_info);
-- 
2.25.1