linux-kernel - [PATCH] scsi: mpt3sas: Fix use-after-free race in event log access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260118053050.313222-1-dg573847474@gmail.com>
Date: Sun, 18 Jan 2026 05:30:50 +0000
From: Chengfeng Ye <dg573847474@...il.com>
To: sathya.prakash@...adcom.com,
	sreekanth.reddy@...adcom.com,
	suganath-prabu.subramani@...adcom.com
Cc: James.Bottomley@...senPartnership.com,
	martin.petersen@...cle.com,
	MPT-FusionLinux.pdl@...adcom.com,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Chengfeng Ye <dg573847474@...il.com>
Subject: [PATCH] scsi: mpt3sas: Fix use-after-free race in event log access

A use-after-free race exists between ioctl operations accessing the
event log and device removal freeing it. The race occurs because
ioc->remove_host flag is set without synchronization, creating
a window where an ioctl can pass the removal check but still access
freed memory.

Race scenario:

  CPU0 (ioctl)                       CPU1 (device removal)
  ----------------                   ---------------------
  _ctl_ioctl_main()
    mutex_lock(&pci_access_mutex)
    if (!ioc->remove_host)
      [check passes]
                                     scsih_remove()
                                       ioc->remove_host = 1
                                       mpt3sas_ctl_release()
                                         kfree(ioc->event_log)

    _ctl_eventreport()
      copy_to_user(..., ioc->event_log, ...)  <- use-after-free
  mutex_unlock(&pci_access_mutex)

Fix by setting ioc->remove_host while holding pci_access_mutex. This
ensures the ioctl path either completes before removal starts, or sees
the flag and returns -EAGAIN.

Signed-off-by: Chengfeng Ye <dg573847474@...il.com>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 7092d0debef3..3086e27a6293 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -11264,7 +11264,10 @@ static void scsih_remove(struct pci_dev *pdev)
 	if (_scsih_get_shost_and_ioc(pdev, &shost, &ioc))
 		return;
 
+	/* Set remove_host flag under pci_access_mutex to synchronize with ioctl path */
+	mutex_lock(&ioc->pci_access_mutex);
 	ioc->remove_host = 1;
+	mutex_unlock(&ioc->pci_access_mutex);
 
 	if (!pci_device_is_present(pdev)) {
 		mpt3sas_base_pause_mq_polling(ioc);
-- 
2.25.1