linux-kernel - Re: [PATCH 5.10] scsi: core: Fix a use-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2024072358-eleven-etching-1988@gregkh>
Date: Tue, 23 Jul 2024 15:33:09 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Maximilian Heyne <mheyne@...zon.de>
Cc: Bart Van Assche <bvanassche@....org>, Ming Lei <ming.lei@...hat.com>,
	Christoph Hellwig <hch@....de>,
	Mike Christie <michael.christie@...cle.com>,
	Hannes Reinecke <hare@...e.de>, John Garry <john.garry@...wei.com>,
	Li Zhijian <lizhijian@...itsu.com>,
	"Martin K . Petersen" <martin.petersen@...cle.com>,
	stable@...r.kernel.org, "James E.J. Bottomley" <jejb@...ux.ibm.com>,
	linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 5.10] scsi: core: Fix a use-after-free

On Tue, Jul 23, 2024 at 11:50:46AM +0000, Maximilian Heyne wrote:
> From: Bart Van Assche <bvanassche@....org>
> 
> [ Upstream commit 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 ]
> 
> There are two .exit_cmd_priv implementations. Both implementations use
> resources associated with the SCSI host. Make sure that these resources are
> still available when .exit_cmd_priv is called by waiting inside
> scsi_remove_host() until the tag set has been freed.
> 
> This commit fixes the following use-after-free:
> 
> ==================================================================
> BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
> Read of size 8 at addr ffff888100337000 by task multipathd/16727
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x34/0x44
>  print_report.cold+0x5e/0x5db
>  kasan_report+0xab/0x120
>  srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
>  scsi_mq_exit_request+0x4d/0x70
>  blk_mq_free_rqs+0x143/0x410
>  __blk_mq_free_map_and_rqs+0x6e/0x100
>  blk_mq_free_tag_set+0x2b/0x160
>  scsi_host_dev_release+0xf3/0x1a0
>  device_release+0x54/0xe0
>  kobject_put+0xa5/0x120
>  device_release+0x54/0xe0
>  kobject_put+0xa5/0x120
>  scsi_device_dev_release_usercontext+0x4c1/0x4e0
>  execute_in_process_context+0x23/0x90
>  device_release+0x54/0xe0
>  kobject_put+0xa5/0x120
>  scsi_disk_release+0x3f/0x50
>  device_release+0x54/0xe0
>  kobject_put+0xa5/0x120
>  disk_release+0x17f/0x1b0
>  device_release+0x54/0xe0
>  kobject_put+0xa5/0x120
>  dm_put_table_device+0xa3/0x160 [dm_mod]
>  dm_put_device+0xd0/0x140 [dm_mod]
>  free_priority_group+0xd8/0x110 [dm_multipath]
>  free_multipath+0x94/0xe0 [dm_multipath]
>  dm_table_destroy+0xa2/0x1e0 [dm_mod]
>  __dm_destroy+0x196/0x350 [dm_mod]
>  dev_remove+0x10c/0x160 [dm_mod]
>  ctl_ioctl+0x2c2/0x590 [dm_mod]
>  dm_ctl_ioctl+0x5/0x10 [dm_mod]
>  __x64_sys_ioctl+0xb4/0xf0
>  dm_ctl_ioctl+0x5/0x10 [dm_mod]
>  __x64_sys_ioctl+0xb4/0xf0
>  do_syscall_64+0x3b/0x90
>  entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> Link: https://lore.kernel.org/r/20220826002635.919423-1-bvanassche@acm.org
> Fixes: 65ca846a5314 ("scsi: core: Introduce {init,exit}_cmd_priv()")
> Cc: Ming Lei <ming.lei@...hat.com>
> Cc: Christoph Hellwig <hch@....de>
> Cc: Mike Christie <michael.christie@...cle.com>
> Cc: Hannes Reinecke <hare@...e.de>
> Cc: John Garry <john.garry@...wei.com>
> Cc: Li Zhijian <lizhijian@...itsu.com>
> Reported-by: Li Zhijian <lizhijian@...itsu.com>
> Tested-by: Li Zhijian <lizhijian@...itsu.com>
> Signed-off-by: Bart Van Assche <bvanassche@....org>
> Signed-off-by: Martin K. Petersen <martin.petersen@...cle.com>
> [mheyne: fixed contextual conflicts:
>   - drivers/scsi/hosts.c: due to missing commit 973dac8a8a14 ("scsi: core: Refine how we set tag_set NUMA node")
>   - drivers/scsi/scsi_sysfs.c: due to missing commit 6f8191fdf41d ("block: simplify disk shutdown")
>   - drivers/scsi/scsi_scan.c: due to missing commit 59506abe5e34 ("scsi: core: Inline scsi_mq_alloc_queue()")]
> Signed-off-by: Maximilian Heyne <mheyne@...zon.de>
> Cc: stable@...r.kernel.org # v5.10

Both now backported, thanks.

greg k-h