archive mirror
 help / color / mirror / Atom feed
From: Bart Van Assche <>
To: Ming Lei <>
Cc: "Martin K . Petersen" <>,, Christoph Hellwig <>,
	Mike Christie <>,
	Hannes Reinecke <>,
	John Garry <>,
	Li Zhijian <>,
	"James E.J. Bottomley" <>
Subject: Re: [PATCH] scsi: core: Fix a use-after-free
Date: Sun, 28 Aug 2022 20:35:07 -0700	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <YwwT5BC+s0VHT5UK@T590>

On 8/28/22 18:18, Ming Lei wrote:
> On Thu, Aug 25, 2022 at 05:26:34PM -0700, Bart Van Assche wrote:
>> There are two .exit_cmd_priv implementations. Both implementations use
>> resources associated with the SCSI host. Make sure that these resources are
>> still available when .exit_cmd_priv is called by waiting inside
>> scsi_remove_host() until the tag set has been freed.
>> This patch fixes the following use-after-free:
>> ==================================================================
>> BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
>> Read of size 8 at addr ffff888100337000 by task multipathd/16727
>> Call Trace:
>>   <TASK>
>>   dump_stack_lvl+0x34/0x44
>>   print_report.cold+0x5e/0x5db
>>   kasan_report+0xab/0x120
>>   srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
>>   scsi_mq_exit_request+0x4d/0x70
>>   blk_mq_free_rqs+0x143/0x410
>>   __blk_mq_free_map_and_rqs+0x6e/0x100
>>   blk_mq_free_tag_set+0x2b/0x160
>>   scsi_host_dev_release+0xf3/0x1a0
> The trace must be triggered on old kernel, cause this issue is fixed by
> upstream since commit f323896fe6fa ("scsi: core: Call blk_mq_free_tag_set() earlier")
> from you, :-)

Hi Ming,

Did you perhaps overlook the patch series "[PATCH 0/4] Revert "Call 
blk_mq_free_tag_set() earlier"" 
This patch reworks the patch series "Call blk_mq_free_tag_set() earlier" 
but without triggering the deadlock reported by syzbot and also here:



  reply	other threads:[~2022-08-29  3:35 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-26  0:26 [PATCH] scsi: core: Fix a use-after-free Bart Van Assche
2022-08-29  1:18 ` Ming Lei
2022-08-29  3:35   ` Bart Van Assche [this message]
2022-09-01  2:46 ` Li Zhijian
2022-09-01  5:12 ` Martin K. Petersen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).