Commit 46ba53c3 authored by Duoming Zhou's avatar Duoming Zhou Committed by Martin K. Petersen

scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()

When executing SMP task failed, the smp_execute_task_sg() calls del_timer()
to delete "slow_task->timer". However, if the timer handler
sas_task_internal_timedout() is running, the del_timer() in
smp_execute_task_sg() will not stop it and a UAF will happen. The process
is shown below:

      (thread 1)               |        (thread 2)
smp_execute_task_sg()          | sas_task_internal_timedout()
 ...                           |
 del_timer()                   |
 ...                           |  ...
 sas_free_task(task)           |
  kfree(task->slow_task) //FREE|
                               |  task->slow_task->... //USE

Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure
the timer handler have finished before the "task->slow_task" is
deallocated.

Link: https://lore.kernel.org/r/20220920144213.10536-1-duoming@zju.edu.cn
Fixes: 2908d778 ("[SCSI] aic94xx: new driver")
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Signed-off-by: default avatarDuoming Zhou <duoming@zju.edu.cn>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent d88a0240
...@@ -67,7 +67,7 @@ static int smp_execute_task_sg(struct domain_device *dev, ...@@ -67,7 +67,7 @@ static int smp_execute_task_sg(struct domain_device *dev,
res = i->dft->lldd_execute_task(task, GFP_KERNEL); res = i->dft->lldd_execute_task(task, GFP_KERNEL);
if (res) { if (res) {
del_timer(&task->slow_task->timer); del_timer_sync(&task->slow_task->timer);
pr_notice("executing SMP task failed:%d\n", res); pr_notice("executing SMP task failed:%d\n", res);
break; break;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment