linux/include/scsi
Bart Van Assche 8fe4ce5836 scsi: core: Fix a use-after-free
There are two .exit_cmd_priv implementations. Both implementations use
resources associated with the SCSI host. Make sure that these resources are
still available when .exit_cmd_priv is called by waiting inside
scsi_remove_host() until the tag set has been freed.

This commit fixes the following use-after-free:

==================================================================
BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
Read of size 8 at addr ffff888100337000 by task multipathd/16727
Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x44
 print_report.cold+0x5e/0x5db
 kasan_report+0xab/0x120
 srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
 scsi_mq_exit_request+0x4d/0x70
 blk_mq_free_rqs+0x143/0x410
 __blk_mq_free_map_and_rqs+0x6e/0x100
 blk_mq_free_tag_set+0x2b/0x160
 scsi_host_dev_release+0xf3/0x1a0
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 scsi_device_dev_release_usercontext+0x4c1/0x4e0
 execute_in_process_context+0x23/0x90
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 scsi_disk_release+0x3f/0x50
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 disk_release+0x17f/0x1b0
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 dm_put_table_device+0xa3/0x160 [dm_mod]
 dm_put_device+0xd0/0x140 [dm_mod]
 free_priority_group+0xd8/0x110 [dm_multipath]
 free_multipath+0x94/0xe0 [dm_multipath]
 dm_table_destroy+0xa2/0x1e0 [dm_mod]
 __dm_destroy+0x196/0x350 [dm_mod]
 dev_remove+0x10c/0x160 [dm_mod]
 ctl_ioctl+0x2c2/0x590 [dm_mod]
 dm_ctl_ioctl+0x5/0x10 [dm_mod]
 __x64_sys_ioctl+0xb4/0xf0
 dm_ctl_ioctl+0x5/0x10 [dm_mod]
 __x64_sys_ioctl+0xb4/0xf0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Link: https://lore.kernel.org/r/20220826002635.919423-1-bvanassche@acm.org
Fixes: 65ca846a53 ("scsi: core: Introduce {init,exit}_cmd_priv()")
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Mike Christie <michael.christie@oracle.com>
Cc: Hannes Reinecke <hare@suse.de>
Cc: John Garry <john.garry@huawei.com>
Cc: Li Zhijian <lizhijian@fujitsu.com>
Reported-by: Li Zhijian <lizhijian@fujitsu.com>
Tested-by: Li Zhijian <lizhijian@fujitsu.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2022-09-01 01:02:10 -04:00
..
fc scsi: libfc: Replace one-element arrays with flexible-array members 2022-02-27 21:17:37 -05:00
fc_frame.h scsi: libfc: Move scsi/fc_encode.h to libfc 2020-10-29 21:49:25 -04:00
fcoe_sysfs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 335 2019-06-05 17:37:06 +02:00
iscsi_if.h scsi: iscsi: Add support for asynchronous iSCSI session destruction 2020-03-11 23:07:57 -04:00
iscsi_proto.h scsi: Fix spelling mistakes in header files 2021-05-21 17:22:45 -04:00
iser.h IB/iser,isert: Create and use new shared header 2015-12-24 00:17:35 -05:00
libfc.h scsi: libfc: Stop using the SCSI pointer 2022-02-22 21:11:05 -05:00
libfcoe.h SCSI misc on 20220524 2022-05-25 19:09:48 -07:00
libiscsi_tcp.h SCSI misc on 20190709 2019-07-11 15:14:01 -07:00
libiscsi.h scsi: libiscsi: Improve conn_send_pdu API 2022-06-21 21:19:23 -04:00
libsas.h scsi: libsas: Introduce struct smp_rps_resp 2022-06-10 13:08:06 -04:00
sas_ata.h scsi: libsas: Refactor sas_ata_hard_reset() 2022-05-19 20:16:25 -04:00
sas.h scsi: libsas: Introduce struct smp_rps_resp 2022-06-10 13:08:06 -04:00
scsi_bsg_iscsi.h scsi: Fix spelling mistakes in header files 2021-05-21 17:22:45 -04:00
scsi_cmnd.h scsi/core: Improve static type checking 2022-07-14 12:14:32 -06:00
scsi_common.h scsi: target: core: Add CONTROL field for trace events 2020-10-02 18:36:19 -04:00
scsi_dbg.h scsi: core: Reduce memory required for SCSI logging 2019-08-07 21:47:29 -04:00
scsi_device.h scsi: core: Revert "Make sure that targets outlive devices" 2022-09-01 01:02:10 -04:00
scsi_devinfo.h scsi: core: Add new flag BLIST_IGN_MEDIA_CHANGE 2021-07-21 23:43:48 -04:00
scsi_dh.h scsi: core: Introduce enum scsi_disposition 2021-04-15 22:44:40 -04:00
scsi_driver.h scsi: don't use disk->private_data to find the scsi_driver 2022-03-08 19:40:00 -07:00
scsi_eh.h scsi: core: Remove the cmd field from struct scsi_request 2022-03-01 22:21:49 -05:00
scsi_host.h scsi: core: Fix a use-after-free 2022-09-01 01:02:10 -04:00
scsi_ioctl.h scsi: remove the gendisk argument to scsi_ioctl 2021-11-29 06:41:29 -07:00
scsi_proto.h scsi: sd: sd_zbc: Hide gap zones 2022-04-25 23:23:05 -04:00
scsi_status.h scsi: core: Introduce enums for the SAM and host status codes 2021-06-02 23:09:39 -04:00
scsi_tcq.h scsi: core: Only return started requests from scsi_host_find_tag() 2020-07-24 22:09:56 -04:00
scsi_transport_fc.h scsi: libfc: Add FDMI-2 attributes 2021-06-10 00:03:56 -04:00
scsi_transport_iscsi.h scsi: iscsi: Add helper to remove a session from the kernel 2022-06-21 21:14:54 -04:00
scsi_transport_sas.h scsi: scsi_transport_sas: Add 22.5 Gbps link rate definitions 2021-10-19 14:07:19 -04:00
scsi_transport_spi.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
scsi_transport_srp.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
scsi_transport.h SCSI misc on 20190709 2019-07-11 15:14:01 -07:00
scsi.h scsi: core: Introduce enums for the SAM and host status codes 2021-06-02 23:09:39 -04:00
scsicam.h scsi: simplify scsi_partsize 2020-03-24 07:57:07 -06:00
sg.h scsi/sg: move sg-big-buff sysctl to scsi/sg.c 2022-01-22 08:33:35 +02:00
srp.h RDMA/srp: Apply the __packed attribute to members instead of structures 2021-05-28 20:21:20 -03:00
viosrp.h scsi: ibmvscsis: Silence -Warray-bounds warning 2022-02-11 16:42:22 -05:00