linux-kernel - Re: [PATCH] scsi: sg: fix slab-use-after-free Read in sg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3fe2a0cf-e652-4e4e-b74f-659eb5ab89e3@acm.org>
Date: Thu, 21 Nov 2024 12:24:02 -0800
From: Bart Van Assche <bvanassche@....org>
To: Suraj Sonawane <surajsonawane0215@...il.com>, dgilbert@...erlog.com
Cc: James.Bottomley@...senPartnership.com, martin.petersen@...cle.com,
 linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzbot+7efb5850a17ba6ce098b@...kaller.appspotmail.com
Subject: Re: [PATCH] scsi: sg: fix slab-use-after-free Read in sg_release

On 11/20/24 4:59 AM, Suraj Sonawane wrote:
> diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
> index f86be197f..457d54171 100644
> --- a/drivers/scsi/sg.c
> +++ b/drivers/scsi/sg.c
> @@ -393,7 +393,6 @@ sg_release(struct inode *inode, struct file *filp)
>   
>   	mutex_lock(&sdp->open_rel_lock);
>   	scsi_autopm_put_device(sdp->device);
> -	kref_put(&sfp->f_ref, sg_remove_sfp);
>   	sdp->open_cnt--;
>   
>   	/* possibly many open()s waiting on exlude clearing, start many;
> @@ -405,6 +404,7 @@ sg_release(struct inode *inode, struct file *filp)
>   		wake_up_interruptible(&sdp->open_wait);
>   	}
>   	mutex_unlock(&sdp->open_rel_lock);
> +	kref_put(&sfp->f_ref, sg_remove_sfp);
>   	return 0;
>   }

Reviewed-by: Bart Van Assche <bvanassche@....org>