[PATCH 5.10/5.15] scsi: ufs: bsg: Set bsg_queue to NULL after removal

[Ilia Gavrilov]

From: "Ilia.Gavrilov" <Ilia.Gavrilov@xxxxxxxxxxx>

From: Guixin Liu <kanie@xxxxxxxxxxxxxxxxx>

commit 1e95c798d8a7f70965f0f88d4657b682ff0ec75f upstream.

Currently, this does not cause any issues, but I believe it is necessary to
set bsg_queue to NULL after removing it to prevent potential use-after-free
(UAF) access.

Signed-off-by: Guixin Liu <kanie@xxxxxxxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20241218014214.64533-3-kanie@xxxxxxxxxxxxxxxxx
Reviewed-by: Avri Altman <avri.altman@xxxxxxx>
Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@xxxxxxxxxxx>
---
Backport fix for CVE-2024-54458
 drivers/scsi/ufs/ufs_bsg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/ufs/ufs_bsg.c b/drivers/scsi/ufs/ufs_bsg.c
index 05c7347eda18..a7e1b011202b 100644
--- a/drivers/scsi/ufs/ufs_bsg.c
+++ b/drivers/scsi/ufs/ufs_bsg.c
@@ -175,6 +175,7 @@ void ufs_bsg_remove(struct ufs_hba *hba)
 		return;
 
 	bsg_remove_queue(hba->bsg_queue);
+	hba->bsg_queue = NULL;
 
 	device_del(bsg_dev);
 	put_device(bsg_dev);
-- 
2.39.5