In the Linux kernel, the following vulnerability has been resolved:
scsi: qedi: Fix use after free bug in qedi_remove()
In qediprobe() we call _qediprobe() which initializes &qedi->recoverywork with qedirecoveryhandler() and &qedi->boarddisablework with qediboarddisable_work().
When qedischedulerecoveryhandler() is called, scheduledelayed_work() will finally start the work.
In qedi_remove(), which is called to remove the driver, the following sequence may be observed:
Fix this by finishing the work before cleanup in qedi_remove().
CPU0 CPU1
|qedi_recovery_handler
qediremove | _qediremove | iscsihostfree | scsihostput | //free shost | |iscsihostforeach_session |//use qedi->shost
Cancel recoverywork and boarddisablework in _qedi_remove().
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54100.json",
"cna_assigner": "Linux"
}