In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix a use-after-free
There are two .exitcmdpriv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exitcmdpriv is called by waiting inside scsiremovehost() until the tag set has been freed.
This commit fixes the following use-after-free:
================================================================== BUG: KASAN: use-after-free in srpexitcmdpriv+0x27/0xd0 [ibsrp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dumpstacklvl+0x34/0x44 printreport.cold+0x5e/0x5db kasanreport+0xab/0x120 srpexitcmdpriv+0x27/0xd0 [ibsrp] scsimqexitrequest+0x4d/0x70 blkmqfreerqs+0x143/0x410 _blkmqfreemapandrqs+0x6e/0x100 blkmqfreetagset+0x2b/0x160 scsihostdevrelease+0xf3/0x1a0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidevicedevreleaseusercontext+0x4c1/0x4e0 executeinprocesscontext+0x23/0x90 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidiskrelease+0x3f/0x50 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 diskrelease+0x17f/0x1b0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 dmputtabledevice+0xa3/0x160 [dmmod] dmputdevice+0xd0/0x140 [dmmod] freeprioritygroup+0xd8/0x110 [dmmultipath] freemultipath+0x94/0xe0 [dmmultipath] dmtabledestroy+0xa2/0x1e0 [dmmod] _dmdestroy+0x196/0x350 [dmmod] devremove+0x10c/0x160 [dmmod] ctlioctl+0x2c2/0x590 [dmmod] dmctlioctl+0x5/0x10 [dmmod] _x64sysioctl+0xb4/0xf0 dmctlioctl+0x5/0x10 [dmmod] _x64sysioctl+0xb4/0xf0 dosyscall64+0x3b/0x90 entrySYSCALL64after_hwframe+0x46/0xb0
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"327986422418226403052375510815112122710",
"7793647103094433527442063979183247071",
"196343519582153514989814758226869583120",
"235634584072427305970003359974703488439"
]
},
"target": {
"file": "drivers/scsi/scsi_sysfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-02954d3f"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"109342093764510201439449360363578946045",
"191527246456792920841108581159245089879",
"220268028945537593400653083127238160969"
]
},
"target": {
"file": "include/scsi/scsi_host.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-0824ec09"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"254266783466609415702768277320527303836",
"3269368324002748130314633074541811449",
"169405910806368155392141908938250001881",
"192084583497653803465342901184464885351",
"222137603901700436306554152797349003063",
"243107795963356352126418348873749761886"
]
},
"target": {
"file": "drivers/scsi/scsi_lib.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-0e75d785"
},
{
"digest": {
"function_hash": "233371600716769957722079693136673905322",
"length": 70.0
},
"target": {
"function": "scsi_mq_destroy_tags",
"file": "drivers/scsi/scsi_lib.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-13f47b9b"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"109342093764510201439449360363578946045",
"191527246456792920841108581159245089879",
"220268028945537593400653083127238160969"
]
},
"target": {
"file": "include/scsi/scsi_host.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-1c9f03a8"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154996619324176838588165411443163958588",
"52016508416150040457284686349382341994",
"225438040392848012581787673000644245488",
"100023113179636360117306596787737564018",
"225178053571615804628854175850897423413",
"303110911467448604567072245816847936308",
"218453133352824356783761099181551421446",
"108019664503469653708217234158899109617",
"285754169035379339231639428978606809437",
"131171481383082420801076522213003945104",
"254487131910886366578497740946963553312",
"25326084680654920112716084322084891101",
"266133765920430775896965243200013402723",
"333976723112475424206215259214869162208",
"94996396758239726989696274802336261773"
]
},
"target": {
"file": "drivers/scsi/hosts.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-26e75560"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"77954759730586316945133392958122027248",
"293630758430609410144785969847200632383",
"180579411098608164654029079485316565817",
"47319036706015558122966266677822372860"
]
},
"target": {
"file": "drivers/scsi/scsi_scan.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-35865268"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"259827657591098493088847198535070098799",
"90561298032972762148558972473141079785",
"161957360426373730179511289915401663767",
"211734028032343033306194752229451838614"
]
},
"target": {
"file": "drivers/scsi/scsi_priv.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-4ae46cd7"
},
{
"digest": {
"function_hash": "233371600716769957722079693136673905322",
"length": 70.0
},
"target": {
"function": "scsi_mq_destroy_tags",
"file": "drivers/scsi/scsi_lib.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-4ddd44e4"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"254266783466609415702768277320527303836",
"3269368324002748130314633074541811449",
"169405910806368155392141908938250001881",
"192084583497653803465342901184464885351",
"222137603901700436306554152797349003063",
"243107795963356352126418348873749761886"
]
},
"target": {
"file": "drivers/scsi/scsi_lib.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-5bb35ce3"
},
{
"digest": {
"function_hash": "178641673455781937467231488674050179058",
"length": 777.0
},
"target": {
"function": "scsi_remove_host",
"file": "drivers/scsi/hosts.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-5fb29ca7"
},
{
"digest": {
"function_hash": "280244400826340519281127698370164700860",
"length": 617.0
},
"target": {
"function": "scsi_host_dev_release",
"file": "drivers/scsi/hosts.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-63ba1081"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"77954759730586316945133392958122027248",
"97553265576888190689055905931210866897",
"238058037237252533828851610468920982832",
"206488964096225859243641000647682283433"
]
},
"target": {
"file": "drivers/scsi/scsi_scan.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-6694e342"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"307374570511709863023012089948458668353",
"115878724951159127342469592111488407553",
"190766767043207463741730771758494721012",
"35761106273562620779604300313627981983"
]
},
"target": {
"file": "drivers/scsi/scsi_sysfs.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-76a2cd98"
},
{
"digest": {
"function_hash": "155537044022047826320720390234281937104",
"length": 617.0
},
"target": {
"function": "scsi_host_dev_release",
"file": "drivers/scsi/hosts.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-7d97d0ea"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"312847570464062295421083253324014695745",
"90561298032972762148558972473141079785",
"161957360426373730179511289915401663767",
"12497942417420946590990534427089315397"
]
},
"target": {
"file": "drivers/scsi/scsi_priv.h"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-913ec948"
},
{
"digest": {
"function_hash": "70219008260282898564261269223981235565",
"length": 1961.0
},
"target": {
"function": "scsi_alloc_sdev",
"file": "drivers/scsi/scsi_scan.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-9b7cd296"
},
{
"digest": {
"function_hash": "25247871044266117761052302983261623171",
"length": 2180.0
},
"target": {
"function": "scsi_add_host_with_dma",
"file": "drivers/scsi/hosts.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-9d08860e"
},
{
"digest": {
"function_hash": "136282958353923329232110026964187558542",
"length": 1785.0
},
"target": {
"function": "scsi_alloc_sdev",
"file": "drivers/scsi/scsi_scan.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-9d19ed59"
},
{
"digest": {
"function_hash": "280757103594656870600492625380476498133",
"length": 963.0
},
"target": {
"function": "__scsi_remove_device",
"file": "drivers/scsi/scsi_sysfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-a1203271"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"178065091733282243822097751215703657562",
"228620702036110203908381129202459553768",
"235090258101293141592827605720671752226",
"78677857376806959750818555999152191873",
"57948468529510823215912268277266620444",
"263535283452136004078891150687388665412",
"218453133352824356783761099181551421446",
"108019664503469653708217234158899109617",
"285754169035379339231639428978606809437",
"131171481383082420801076522213003945104",
"296307064699128964197660169330699816978",
"25326084680654920112716084322084891101",
"266133765920430775896965243200013402723",
"333976723112475424206215259214869162208",
"94996396758239726989696274802336261773"
]
},
"target": {
"file": "drivers/scsi/hosts.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"id": "CVE-2022-48666-b4a10e8e"
},
{
"digest": {
"function_hash": "221292903575624564672180400325144505973",
"length": 807.0
},
"target": {
"function": "scsi_remove_host",
"file": "drivers/scsi/hosts.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-c2407bf1"
},
{
"digest": {
"function_hash": "269231836306960720863788883303890724553",
"length": 1040.0
},
"target": {
"function": "__scsi_remove_device",
"file": "drivers/scsi/scsi_sysfs.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-c313be70"
},
{
"digest": {
"function_hash": "171852542666102915230779054082503708000",
"length": 2180.0
},
"target": {
"function": "scsi_add_host_with_dma",
"file": "drivers/scsi/hosts.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"id": "CVE-2022-48666-c85afb20"
}
]