diff mbox series

[SRU,F,2/2] scsi: pm8001: Fix use-after-free for aborted TMF sas_task

Message ID 55f301bf8a5dfdb03221950c1e9771bec870f2f9.1724076727.git.juerg.haefliger@canonical.com
State New
Headers show
Series CVE-2022-48791 | expand

Commit Message

Juerg Haefliger Aug. 19, 2024, 2:21 p.m. UTC 
From: John Garry <john.garry@huawei.com>

Currently a use-after-free may occur if a TMF sas_task is aborted before we
handle the IO completion in mpi_ssp_completion(). The abort occurs due to
timeout.

When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the
sas_task is freed in pm8001_exec_internal_tmf_task().

However, if the I/O completion occurs later, the I/O completion still
thinks that the sas_task is available. Fix this by clearing the ccb->task
if the TMF times out - the I/O completion handler does nothing if this
pointer is cleared.

Link: https://lore.kernel.org/r/1643289172-165636-3-git-send-email-john.garry@huawei.com
Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(backported from commit 61f162aa4381845acbdc7f2be4dfb694d027c018)
[juergh: Adjusted context due to missing commit:
 1b5d2793283d ("scsi: pm8001: Neaten debug logging macros and uses")]
CVE-2022-48791
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
---
 drivers/scsi/pm8001/pm8001_sas.c | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox series

Patch

diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 25cf9db45d54..cb573061164b 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -751,9 +751,14 @@  static int pm8001_exec_internal_tmf_task(struct domain_device *dev,
 		res = -TMF_RESP_FUNC_FAILED;
 		/* Even TMF timed out, return direct. */
 		if (task->task_state_flags & SAS_TASK_STATE_ABORTED) {
+			struct pm8001_ccb_info *ccb = task->lldd_task;
+
 			PM8001_FAIL_DBG(pm8001_ha,
 				pm8001_printk("TMF task[%x]timeout.\n",
 				tmf->tmf));
+
+			if (ccb)
+				ccb->task = NULL;
 			goto ex_err;
 		}