From: Bart Van Assche <bvanassche@acm.org>
To: Ming Lei <ming.lei@redhat.com>
Cc: "Martin K . Petersen" <martin.petersen@oracle.com>,
linux-scsi@vger.kernel.org, Christoph Hellwig <hch@lst.de>,
Mike Christie <michael.christie@oracle.com>,
Hannes Reinecke <hare@suse.de>,
John Garry <john.garry@huawei.com>,
Li Zhijian <lizhijian@fujitsu.com>,
"James E.J. Bottomley" <jejb@linux.ibm.com>
Subject: Re: [PATCH] scsi: core: Fix a use-after-free
Date: Sun, 28 Aug 2022 20:35:07 -0700 [thread overview]
Message-ID: <aa14894e-305b-b18b-a2c8-ad411cb75460@acm.org> (raw)
In-Reply-To: <YwwT5BC+s0VHT5UK@T590>
On 8/28/22 18:18, Ming Lei wrote:
> On Thu, Aug 25, 2022 at 05:26:34PM -0700, Bart Van Assche wrote:
>> There are two .exit_cmd_priv implementations. Both implementations use
>> resources associated with the SCSI host. Make sure that these resources are
>> still available when .exit_cmd_priv is called by waiting inside
>> scsi_remove_host() until the tag set has been freed.
>>
>> This patch fixes the following use-after-free:
>>
>> ==================================================================
>> BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
>> Read of size 8 at addr ffff888100337000 by task multipathd/16727
>> Call Trace:
>> <TASK>
>> dump_stack_lvl+0x34/0x44
>> print_report.cold+0x5e/0x5db
>> kasan_report+0xab/0x120
>> srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
>> scsi_mq_exit_request+0x4d/0x70
>> blk_mq_free_rqs+0x143/0x410
>> __blk_mq_free_map_and_rqs+0x6e/0x100
>> blk_mq_free_tag_set+0x2b/0x160
>> scsi_host_dev_release+0xf3/0x1a0
>
> The trace must be triggered on old kernel, cause this issue is fixed by
> upstream since commit f323896fe6fa ("scsi: core: Call blk_mq_free_tag_set() earlier")
> from you, :-)
Hi Ming,
Did you perhaps overlook the patch series "[PATCH 0/4] Revert "Call
blk_mq_free_tag_set() earlier""
(https://lore.kernel.org/linux-scsi/20220821220502.13685-1-bvanassche@acm.org/)?
This patch reworks the patch series "Call blk_mq_free_tag_set() earlier"
but without triggering the deadlock reported by syzbot and also here:
https://lore.kernel.org/all/Yv%2FMKymRC9O04Nqu@google.com/
Thanks,
Bart.
next prev parent reply other threads:[~2022-08-29 3:35 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-26 0:26 [PATCH] scsi: core: Fix a use-after-free Bart Van Assche
2022-08-29 1:18 ` Ming Lei
2022-08-29 3:35 ` Bart Van Assche [this message]
2022-09-01 2:46 ` Li Zhijian
2022-09-01 5:12 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aa14894e-305b-b18b-a2c8-ad411cb75460@acm.org \
--to=bvanassche@acm.org \
--cc=hare@suse.de \
--cc=hch@lst.de \
--cc=jejb@linux.ibm.com \
--cc=john.garry@huawei.com \
--cc=linux-scsi@vger.kernel.org \
--cc=lizhijian@fujitsu.com \
--cc=martin.petersen@oracle.com \
--cc=michael.christie@oracle.com \
--cc=ming.lei@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).