Duoming Zhou e45a1516d2 scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() ... [ Upstream commit 46ba53c306 ] When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete "slow_task->timer". However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below: (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the "task->slow_task" is deallocated. Link: https://lore.kernel.org/r/20220920144213.10536-1-duoming@zju.edu.cn Fixes: 2908d778ab ("[SCSI] aic94xx: new driver") Reviewed-by: Jason Yan <yanaijie@huawei.com> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-10-26 12:35:15 +02:00
..
Kconfig	scsi: libsas: Drop BLK_DEV_BSGLIB selection	2021-07-27 00:06:42 -04:00
Makefile	scsi: libsas: Allow libsas to include SCSI header files directly	2021-07-20 23:11:17 -04:00
sas_ata.c	scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands	2022-04-08 14:22:54 +02:00
sas_discover.c	scsi: libsas: Allow libsas to include SCSI header files directly	2021-07-20 23:11:17 -04:00
sas_event.c	scsi: libsas: Remove temporarily-added _gfp() API variants	2021-01-22 21:31:10 -05:00
sas_expander.c	scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()	2022-10-26 12:35:15 +02:00
sas_host_smp.c	scsi: libsas: Allow libsas to include SCSI header files directly	2021-07-20 23:11:17 -04:00
sas_init.c	scsi: libsas: Allow libsas to include SCSI header files directly	2021-07-20 23:11:17 -04:00
sas_internal.h	scsi: libsas: Remove temporarily-added _gfp() API variants	2021-01-22 21:31:10 -05:00
sas_phy.c	scsi: libsas: Allow libsas to include SCSI header files directly	2021-07-20 23:11:17 -04:00
sas_port.c	scsi: libsas: Allow libsas to include SCSI header files directly	2021-07-20 23:11:17 -04:00
sas_scsi_host.c	scsi: libsas: Use scsi_cmd_to_rq() instead of scsi_cmnd.request	2021-08-11 22:25:39 -04:00
sas_task.c	scsi: libsas: Introduce more SAM status code aliases in enum exec_status	2021-06-02 16:10:46 -04:00