linux-kernel - Re: [PATCH RESEND] scsi: ppa: Fix use-after-free caused by unfinished delayed work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3a85ddef.523b2.19b81abea97.Coremail.duoming@zju.edu.cn>
Date: Sat, 3 Jan 2026 10:24:46 +0800 (GMT+08:00)
From: duoming@....edu.cn
To: "James Bottomley" <James.Bottomley@...senPartnership.com>
Cc: linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
	martin.petersen@...cle.com, stable@...nel.org
Subject: Re: [PATCH RESEND] scsi: ppa: Fix use-after-free caused by
 unfinished delayed work

On Thu, 01 Jan 2026 10:21:28 -0500, James Bottomley wrote:
> > diff --git a/drivers/scsi/ppa.c b/drivers/scsi/ppa.c
> > index ea682f3044b..8da2a78ebac 100644
> > --- a/drivers/scsi/ppa.c
> > +++ b/drivers/scsi/ppa.c
> > @@ -1136,6 +1136,7 @@ static void ppa_detach(struct parport *pb)
> >  	ppa_struct *dev;
> >  	list_for_each_entry(dev, &ppa_hosts, list) {
> >  		if (dev->dev->port == pb) {
> > +			disable_delayed_work_sync(&dev->ppa_tq);
> >  			list_del_init(&dev->list);
> >  			scsi_remove_host(dev->host);
> >  			scsi_host_put(dev->host);
> 
> This fix looks bogus: if there's an active workqueue on ppa it's
> because there's an outstanding command and it's emulating polling.  If
> you stop the polling by disabling the workqueue, the command will never
> return and the host will never get freed, so this will leak resources,
> won't it?

I believe that disabling the ppa_tq delayed work will not affect the Scsi_Host
release process. The lifetime of the Scsi_Host is managed by tagset_refcnt.
The tagset_refcnt is initialized to 1 in scsi_add_host_with_dma() and decreased
to 0 in scsi_remove_host(). since the delayed work callback ppa_interrupt() 
does not modify tagset_refcnt in any way, the host could be freed as expected.

> Also the race condition you identify is one of many tied to an
> incorrect ppa_struct lifetime: it should never be free'd before the
> host itself is gone because a live host may do a callback which will
> get the ppa_struct from hostdata, so if the host is still alive for any
> reason when ppa_detach() is called, we'll get the same problem.

The ppa_struct is properly freed only after ensuring the complete removal
of the associated Scsi_Host in ppa_detach(). The detailed sequence is as
follows:

...
   scsi_remove_host(dev->host);
   scsi_host_put(dev->host); //the host is gone
   parport_unregister_device(dev->dev);
   kfree(dev); //free ppa_struct
...

The scsi_remove_host() initiates the host removal process, transitioning
it through appropriate states(SHOST_CANCEL, SHOST_DEL) and ensuring all
pending I/O operations are properly handled. This sequence ensures that
all resources associated with the Scsi_Host are properly cleaned up before
the ppa_struct is freed.

Best regards,
Duoming Zhou