• Bart Van Assche's avatar
    scsi: core: Fix a use-after-free · 8fe4ce58
    Bart Van Assche authored
    There are two .exit_cmd_priv implementations. Both implementations use
    resources associated with the SCSI host. Make sure that these resources are
    still available when .exit_cmd_priv is called by waiting inside
    scsi_remove_host() until the tag set has been freed.
    
    This commit fixes the following use-after-free:
    
    ==================================================================
    BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
    Read of size 8 at addr ffff888100337000 by task multipathd/16727
    Call Trace:
     <TASK>
     dump_stack_lvl+0x34/0x44
     print_report.cold+0x5e/0x5db
     kasan_report+0xab/0x120
     srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
     scsi_mq_exit_request+0x4d/0x70
     blk_mq_free_rqs+0x143/0x410
     __blk_mq_free_map_and_rqs+0x6e/0x100
     blk_mq_free_tag_set+0x2b/0x160
     scsi_host_dev_release+0xf3/0x1a0
     device_release+0x54/0xe0
     kobject_put+0xa5/0x120
     device_release+0x54/0xe0
     kobject_put+0xa5/0x120
     scsi_device_dev_release_usercontext+0x4c1/0x4e0
     execute_in_process_context+0x23/0x90
     device_release+0x54/0xe0
     kobject_put+0xa5/0x120
     scsi_disk_release+0x3f/0x50
     device_release+0x54/0xe0
     kobject_put+0xa5/0x120
     disk_release+0x17f/0x1b0
     device_release+0x54/0xe0
     kobject_put+0xa5/0x120
     dm_put_table_device+0xa3/0x160 [dm_mod]
     dm_put_device+0xd0/0x140 [dm_mod]
     free_priority_group+0xd8/0x110 [dm_multipath]
     free_multipath+0x94/0xe0 [dm_multipath]
     dm_table_destroy+0xa2/0x1e0 [dm_mod]
     __dm_destroy+0x196/0x350 [dm_mod]
     dev_remove+0x10c/0x160 [dm_mod]
     ctl_ioctl+0x2c2/0x590 [dm_mod]
     dm_ctl_ioctl+0x5/0x10 [dm_mod]
     __x64_sys_ioctl+0xb4/0xf0
     dm_ctl_ioctl+0x5/0x10 [dm_mod]
     __x64_sys_ioctl+0xb4/0xf0
     do_syscall_64+0x3b/0x90
     entry_SYSCALL_64_after_hwframe+0x46/0xb0
    
    Link: https://lore.kernel.org/r/20220826002635.919423-1-bvanassche@acm.org
    Fixes: 65ca846a ("scsi: core: Introduce {init,exit}_cmd_priv()")
    Cc: Ming Lei <ming.lei@redhat.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Mike Christie <michael.christie@oracle.com>
    Cc: Hannes Reinecke <hare@suse.de>
    Cc: John Garry <john.garry@huawei.com>
    Cc: Li Zhijian <lizhijian@fujitsu.com>
    Reported-by: default avatarLi Zhijian <lizhijian@fujitsu.com>
    Tested-by: default avatarLi Zhijian <lizhijian@fujitsu.com>
    Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
    Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
    8fe4ce58
scsi_host.h 26.4 KB