Re: [PATCH] scsi: libsas: fix use-after-free bug in smp_execute_task_sg

From: Jason Yan
Date: Thu Sep 22 2022 - 10:06:39 EST



On 2022/9/20 22:42, Duoming Zhou wrote:
When executing SMP task failed, the smp_execute_task_sg()
calls del_timer() to delete the "slow_task->timer". However,
if the timer handler sas_task_internal_timedout() is running,
the del_timer() in smp_execute_task_sg() will not stop it
and the UAF bug will happen. The process is shown below:

(thread 1) | (thread 2)
smp_execute_task_sg() | sas_task_internal_timedout()
... |
del_timer() |
... | ...
sas_free_task(task) |
kfree(task->slow_task) //FREE|
| task->slow_task->... //USE

Fix by calling del_timer_sync() in smp_execute_task_sg(),
which makes sure the timer handler have finished before
the "task->slow_task" is deallocated.

Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
---
drivers/scsi/libsas/sas_expander.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index fa2209080cc..5ce25183010 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -67,7 +67,7 @@ static int smp_execute_task_sg(struct domain_device *dev,
res = i->dft->lldd_execute_task(task, GFP_KERNEL);
if (res) {
- del_timer(&task->slow_task->timer);
+ del_timer_sync(&task->slow_task->timer);
pr_notice("executing SMP task failed:%d\n", res);
break;
}


The timer should be triggered 10 seconds later. I am curious why we stay
this long before del_timer().

However this change looks good to me.
Reviewed-by: Jason Yan <yanaijie@xxxxxxxxxx>