linux-kernel - [PATCH v2 RESEND] scsi: mpt3sas: Fix use-after-free race in event log access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20260118084135.321976-1-dg573847474@gmail.com>
Date: Sun, 18 Jan 2026 08:41:35 +0000
From: Chengfeng Ye <dg573847474@...il.com>
To: sathya.prakash@...adcom.com,
	sreekanth.reddy@...adcom.com,
	suganath-prabu.subramani@...adcom.com,
	Markus.Elfring@....de
Cc: James.Bottomley@...senPartnership.com,
	martin.petersen@...cle.com,
	MPT-FusionLinux.pdl@...adcom.com,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Chengfeng Ye <dg573847474@...il.com>,
	Tomas Henzl <thenzl@...hat.com>
Subject: [PATCH v2 RESEND] scsi: mpt3sas: Fix use-after-free race in event log access

A use-after-free race exists between ioctl operations accessing the
event log and device removal freeing it. The race occurs because
ioc->remove_host flag is set without synchronization, creating
a window where an ioctl can pass the removal check but still access
freed memory.

Race scenario:

  CPU0 (ioctl)                       CPU1 (device removal)
  ----------------                   ---------------------
  _ctl_ioctl_main()
    mutex_lock(&pci_access_mutex)
    if (!ioc->remove_host)
      [check passes]
                                     scsih_remove()
                                       ioc->remove_host = 1
                                       mpt3sas_ctl_release()
                                         kfree(ioc->event_log)

    _ctl_eventreport()
      copy_to_user(..., ioc->event_log, ...)  <- use-after-free
  mutex_unlock(&pci_access_mutex)

Fix by setting ioc->remove_host while holding pci_access_mutex. This
ensures the ioctl path either completes before removal starts, or sees
the flag and returns -EAGAIN.

Fixes: 6a965ee1892a ("scsi: mpt3sas: Suppress a warning in debug kernel")
Signed-off-by: Chengfeng Ye <dg573847474@...il.com>
CC: Markus Elfring <Markus.Elfring@....de>
CC: Sathya Prakash <sathya.prakash@...adcom.com>
CC: Sreekanth Reddy <sreekanth.reddy@...adcom.com>
CC: Suganath Prabu Subramani <suganath-prabu.subramani@...adcom.com>
CC: James E.J. Bottomley <James.Bottomley@...senPartnership.com>
CC: Martin K. Petersen <martin.petersen@...cle.com>
CC: Tomas Henzl <thenzl@...hat.com>
---
V1 -> V2: Use scoped_guard instead of lock/unlock pair

 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 7092d0debef3..973893528747 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -11264,7 +11264,10 @@ static void scsih_remove(struct pci_dev *pdev)
 	if (_scsih_get_shost_and_ioc(pdev, &shost, &ioc))
 		return;
 
-	ioc->remove_host = 1;
+	/* Set remove_host flag under pci_access_mutex to synchronize with ioctl path */
+	scoped_guard(mutex, &ioc->pci_access_mutex) {
+		ioc->remove_host = 1;
+	}
 
 	if (!pci_device_is_present(pdev)) {
 		mpt3sas_base_pause_mq_polling(ioc);
-- 
2.25.1