From: Bart Van Assche <bvanassche@acm.org>
To: "Martin K . Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org, Bart Van Assche <bvanassche@acm.org>,
Jun'ichi Nomura <j-nomura@ce.jp.nec.com>,
Christoph Hellwig <hch@lst.de>, Ming Lei <ming.lei@redhat.com>,
Hannes Reinecke <hare@suse.de>,
John Garry <john.garry@huawei.com>,
Mike Christie <michael.christie@oracle.com>,
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>,
"James E.J. Bottomley" <jejb@linux.ibm.com>,
James Bottomley <JBottomley@Odin.com>
Subject: [PATCH v5 5/7] scsi: core: Fix a use-after-free related to releasing device handlers
Date: Wed, 14 Sep 2022 15:56:19 -0700 [thread overview]
Message-ID: <20220914225621.415631-6-bvanassche@acm.org> (raw)
In-Reply-To: <20220914225621.415631-1-bvanassche@acm.org>
The SCSI device name can be freed by kobject_cleanup() before
scsi_device_dev_release_usercontext() is called since the latter function
may be called asynchronously. Hence, the SCSI device name must not be
dereferenced from inside the SCSI device release function. Since
scsi_dh_release_device() dereferences the SCSI device name, call it
earlier. This patch fixes the following use-after-free:
BUG: KASAN: use-after-free in string+0xdc/0x1d0
Read of size 1 at addr ffff8881280d05f0 by task kworker/54:2/1373
CPU: 54 PID: 1373 Comm: kworker/54:2 Tainted: G E 6.0.0-rc5-dbg #12
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
Workqueue: events scsi_device_dev_release_usercontext
Call Trace:
<TASK>
show_stack+0x4e/0x53
dump_stack_lvl+0x51/0x66
print_address_description.constprop.0.cold+0xd5/0x412
print_report.cold+0x90/0x219
kasan_report+0xb1/0xe0
__asan_load1+0x4d/0x50
string+0xdc/0x1d0
vsnprintf+0x44d/0x7f0
snprintf+0x88/0xa0
dev_vprintk_emit+0x19c/0x1dc
dev_printk_emit+0x8c/0xa6
__dev_printk+0x73/0x8f
_dev_printk+0xa8/0xbe
sdev_prefix_printk+0x12c/0x180
scsi_dh_release_device+0x74/0xa0
scsi_device_dev_release_usercontext+0x60/0x8a0
process_one_work+0x571/0xa40
worker_thread+0x90/0x650
kthread+0x185/0x1c0
ret_from_fork+0x1f/0x30
Freed by task 509:
kasan_save_stack+0x26/0x50
kasan_set_track+0x25/0x30
kasan_set_free_info+0x24/0x40
____kasan_slab_free+0x155/0x1c0
__kasan_slab_free+0x12/0x20
kfree+0x1fe/0x3e0
kfree_const+0x21/0x30
kobject_cleanup+0x8d/0x1c0
kobject_put+0x6e/0x90
put_device+0x13/0x20
__scsi_remove_device+0x140/0x200
scsi_forget_host+0xa7/0xb0
scsi_remove_host+0x9b/0x1b0
srp_remove_work+0x12b/0x2e0 [ib_srp]
process_one_work+0x571/0xa40
worker_thread+0x90/0x650
kthread+0x185/0x1c0
ret_from_fork+0x1f/0x30
Cc: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Hannes Reinecke <hare@suse.de>
Cc: John Garry <john.garry@huawei.com>
Cc: Mike Christie <michael.christie@oracle.com>
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Fixes: 23695e41a1ca ("scsi_dh: fix use-after-free when removing scsi device")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/scsi/scsi_sysfs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 5d61f58399dc..a3aaafdeac1d 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -456,8 +456,6 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
mod = sdev->host->hostt->module;
- scsi_dh_release_device(sdev);
-
parent = sdev->sdev_gendev.parent;
spin_lock_irqsave(sdev->host->host_lock, flags);
@@ -1479,6 +1477,9 @@ void __scsi_remove_device(struct scsi_device *sdev)
kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags);
cancel_work_sync(&sdev->requeue_work);
+ /* Only detach the device handler after I/O processing has finished. */
+ scsi_dh_release_device(sdev);
+
if (sdev->host->hostt->slave_destroy)
sdev->host->hostt->slave_destroy(sdev);
transport_destroy_device(dev);
next prev parent reply other threads:[~2022-09-14 22:57 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-14 22:56 [PATCH v5 0/7] Prepare for constifying SCSI host templates Bart Van Assche
2022-09-14 22:56 ` [PATCH v5 1/7] scsi: esas2r: Initialize two host template members implicitly Bart Van Assche
2022-09-14 22:56 ` [PATCH v5 2/7] scsi: esas2r: Introduce scsi_template_proc_dir() Bart Van Assche
2022-09-14 22:56 ` [PATCH v5 3/7] scsi: core: Fail host creation if creating the proc directory fails Bart Van Assche
2022-09-15 10:24 ` John Garry
2022-09-14 22:56 ` [PATCH v5 4/7] scsi: core: Introduce a new list for SCSI proc directory entries Bart Van Assche
2022-09-15 10:34 ` John Garry
2022-09-29 17:51 ` Bart Van Assche
2022-09-14 22:56 ` Bart Van Assche [this message]
2022-09-14 22:56 ` [PATCH v5 6/7] module: Improve support for asynchronous module exit code Bart Van Assche
2022-09-20 17:13 ` Bart Van Assche
2022-09-28 0:02 ` Luis Chamberlain
2022-09-28 18:17 ` Bart Van Assche
2022-09-30 19:39 ` Luis Chamberlain
2022-10-03 23:56 ` Luis Chamberlain
2022-10-04 0:24 ` Bart Van Assche
2022-09-28 1:09 ` Ming Lei
2022-09-28 19:27 ` Bart Van Assche
2022-09-29 1:10 ` Ming Lei
2022-09-29 17:27 ` Bart Van Assche
2022-09-14 22:56 ` [PATCH v5 7/7] scsi: core: Improve SCSI device removal Bart Van Assche
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220914225621.415631-6-bvanassche@acm.org \
--to=bvanassche@acm.org \
--cc=JBottomley@Odin.com \
--cc=hare@suse.de \
--cc=hch@lst.de \
--cc=j-nomura@ce.jp.nec.com \
--cc=jejb@linux.ibm.com \
--cc=john.garry@huawei.com \
--cc=krzysztof.kozlowski@linaro.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=michael.christie@oracle.com \
--cc=ming.lei@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.