linux-kernel - Re: [PATCH] scsi: mpt3sas: Fix use-after-free race in event log access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fba6aaf6-3487-426c-bc57-618c30644c18@web.de>
Date: Sun, 18 Jan 2026 07:05:07 +0100
From: Markus Elfring <Markus.Elfring@....de>
To: Chengfeng Ye <dg573847474@...il.com>, linux-scsi@...r.kernel.org,
 MPT-FusionLinux.pdl@...adcom.com,
 James Bottomley <James.Bottomley@...senPartnership.com>,
 "Martin K. Petersen" <martin.petersen@...cle.com>,
 Sathya Prakash <sathya.prakash@...adcom.com>,
 Sreekanth Reddy <sreekanth.reddy@...adcom.com>,
 Suganath Prabu Subramani <suganath-prabu.subramani@...adcom.com>
Cc: LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] scsi: mpt3sas: Fix use-after-free race in event log
 access

…
> Fix by setting ioc->remove_host while holding pci_access_mutex. This
> ensures the ioctl path either completes before removal starts, or sees
> the flag and returns -EAGAIN.

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?

…
> +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
> @@ -11264,7 +11264,10 @@ static void scsih_remove(struct pci_dev *pdev)
>  	if (_scsih_get_shost_and_ioc(pdev, &shost, &ioc))
>  		return;
>  
> +	/* Set remove_host flag under pci_access_mutex to synchronize with ioctl path */
> +	mutex_lock(&ioc->pci_access_mutex);
>  	ioc->remove_host = 1;
> +	mutex_unlock(&ioc->pci_access_mutex);

Would it become feasible to apply a scoped_guard() call?
https://elixir.bootlin.com/linux/v6.19-rc5/source/include/linux/mutex.h#L253

>  
>  	if (!pci_device_is_present(pdev)) {
>  		mpt3sas_base_pause_mq_polling(ioc);

Regards,
Markus