From: "Martin K. Petersen" <martin.petersen@oracle.com>
To: linux-scsi@vger.kernel.org
Cc: "Martin K . Petersen" <martin.petersen@oracle.com>
Subject: Re: [PATCH v2] scsi: mpt3sas: fix use after free in _scsih_expander_node_remove()
Date: Thu, 7 Apr 2022 09:35:03 -0400 [thread overview]
Message-ID: <164929678997.15424.5303213551009228928.b4-ty@oracle.com> (raw)
In-Reply-To: <20220322055702.95276-1-damien.lemoal@opensource.wdc.com>
On Tue, 22 Mar 2022 14:57:02 +0900, Damien Le Moal wrote:
> The function mpt3sas_transport_port_remove() called in
> _scsih_expander_node_remove() frees the port field of the sas_expander
> structure, leading to the following use-after-free splat from Kasan when
> the ioc_info() call following that function is executed (e.g. when doing
> rmmod of the driver module):
>
> [ 3479.371167] ==================================================================
> [ 3479.378496] BUG: KASAN: use-after-free in _scsih_expander_node_remove+0x710/0x750 [mpt3sas]
> [ 3479.386936] Read of size 1 at addr ffff8881c037691c by task rmmod/1531
> [ 3479.393524]
> [ 3479.395035] CPU: 18 PID: 1531 Comm: rmmod Not tainted 5.17.0-rc8+ #1436
> [ 3479.401712] Hardware name: Supermicro Super Server/H12SSL-NT, BIOS 2.1 06/02/2021
> [ 3479.409263] Call Trace:
> [ 3479.411743] <TASK>
> [ 3479.413875] dump_stack_lvl+0x45/0x59
> [ 3479.417582] print_address_description.constprop.0+0x1f/0x120
> [ 3479.423389] ? _scsih_expander_node_remove+0x710/0x750 [mpt3sas]
> [ 3479.429469] kasan_report.cold+0x83/0xdf
> [ 3479.433438] ? _scsih_expander_node_remove+0x710/0x750 [mpt3sas]
> [ 3479.439514] _scsih_expander_node_remove+0x710/0x750 [mpt3sas]
> [ 3479.445411] ? _raw_spin_unlock_irqrestore+0x2d/0x40
> [ 3479.452032] scsih_remove+0x525/0xc90 [mpt3sas]
> [ 3479.458212] ? mpt3sas_expander_remove+0x1d0/0x1d0 [mpt3sas]
> [ 3479.465529] ? down_write+0xde/0x150
> [ 3479.470746] ? up_write+0x14d/0x460
> [ 3479.475840] ? kernfs_find_ns+0x137/0x310
> [ 3479.481438] pci_device_remove+0x65/0x110
> [ 3479.487013] __device_release_driver+0x316/0x680
> [ 3479.493180] driver_detach+0x1ec/0x2d0
> [ 3479.498499] bus_remove_driver+0xe7/0x2d0
> [ 3479.504081] pci_unregister_driver+0x26/0x250
> [ 3479.510033] _mpt3sas_exit+0x2b/0x6cf [mpt3sas]
> [ 3479.516144] __x64_sys_delete_module+0x2fd/0x510
> [ 3479.522315] ? free_module+0xaa0/0xaa0
> [ 3479.527593] ? __cond_resched+0x1c/0x90
> [ 3479.532951] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
> [ 3479.539607] ? syscall_enter_from_user_mode+0x21/0x70
> [ 3479.546161] ? trace_hardirqs_on+0x1c/0x110
> [ 3479.551828] do_syscall_64+0x35/0x80
> [ 3479.556884] entry_SYSCALL_64_after_hwframe+0x44/0xae
> [ 3479.563402] RIP: 0033:0x7f1fc482483b
> ...
> [ 3479.943087] ==================================================================
>
> [...]
Applied to 5.18/scsi-fixes, thanks!
[1/1] scsi: mpt3sas: fix use after free in _scsih_expander_node_remove()
https://git.kernel.org/mkp/scsi/c/87d663d40801
--
Martin K. Petersen Oracle Linux Engineering
prev parent reply other threads:[~2022-04-07 13:35 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-22 5:57 [PATCH v2] scsi: mpt3sas: fix use after free in _scsih_expander_node_remove() Damien Le Moal
2022-03-22 6:34 ` Sreekanth Reddy
2022-03-30 2:56 ` Martin K. Petersen
2022-04-07 13:35 ` Martin K. Petersen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=164929678997.15424.5303213551009228928.b4-ty@oracle.com \
--to=martin.petersen@oracle.com \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.