CVE-2022-48666

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix a use-after-free

There are two .exitcmdpriv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exitcmdpriv is called by waiting inside scsiremovehost() until the tag set has been freed.

This commit fixes the following use-after-free:

================================================================== BUG: KASAN: use-after-free in srpexitcmdpriv+0x27/0xd0 [ibsrp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dumpstacklvl+0x34/0x44 printreport.cold+0x5e/0x5db kasanreport+0xab/0x120 srpexitcmdpriv+0x27/0xd0 [ibsrp] scsimqexitrequest+0x4d/0x70 blkmqfreerqs+0x143/0x410 __blkmqfree_mapandrqs+0x6e/0x100 blkmqfreetagset+0x2b/0x160 scsihostdevrelease+0xf3/0x1a0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidevicedevreleaseusercontext+0x4c1/0x4e0 executeinprocesscontext+0x23/0x90 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 scsidiskrelease+0x3f/0x50 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 diskrelease+0x17f/0x1b0 devicerelease+0x54/0xe0 kobjectput+0xa5/0x120 dmputtabledevice+0xa3/0x160 [dmmod] dmputdevice+0xd0/0x140 [dmmod] freeprioritygroup+0xd8/0x110 [dmmultipath] freemultipath+0x94/0xe0 [dmmultipath] dmtabledestroy+0xa2/0x1e0 [dmmod] __dmdestroy+0x196/0x350 [dmmod] dev_remove+0x10c/0x160 [dmmod] ctlioctl+0x2c2/0x590 [dmmod] dmctlioctl+0x5/0x10 [dmmod] __x64sysioctl+0xb4/0xf0 dm_ctlioctl+0x5/0x10 [dmmod] __x64sysioctl+0xb4/0xf0 dosyscall64+0x3b/0x90 entrySYSCALL64afterhwframe+0x46/0xb0