A use-after-free race exists between ioctl operations accessing the
event log and device removal freeing it. The race occurs because
ioc->remove_host flag is set without synchronization, creating
a window where an ioctl can pass the removal check but still access
freed memory.
Race scenario:
CPU0 (ioctl) CPU1 (device removal)
---------------- ---------------------
_ctl_ioctl_main()
mutex_lock(&pci_access_mutex)
if (!ioc->remove_host)
[check passes]
scsih_remove()
ioc->remove_host = 1
mpt3sas_ctl_release()
kfree(ioc->event_log)
_ctl_eventreport()
copy_to_user(..., ioc->event_log, ...) <- use-after-free
mutex_unlock(&pci_access_mutex)
Fix by setting ioc->remove_host while holding pci_access_mutex. This
ensures the ioctl path either completes before removal starts, or sees
the flag and returns -EAGAIN.
Fixes: 6a965ee1892a ("scsi: mpt3sas: Suppress a warning in debug kernel")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
CC: Markus Elfring <Markus.Elfring@web.de>
CC: Sathya Prakash <sathya.prakash@broadcom.com>
CC: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
CC: Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>
CC: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
CC: Martin K. Petersen <martin.petersen@oracle.com>
CC: Tomas Henzl <thenzl@redhat.com>
---
V1 -> V2: Use scoped_guard instead of lock/unlock pair
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 7092d0debef3..973893528747 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -11264,7 +11264,10 @@ static void scsih_remove(struct pci_dev *pdev)
if (_scsih_get_shost_and_ioc(pdev, &shost, &ioc))
return;
- ioc->remove_host = 1;
+ /* Set remove_host flag under pci_access_mutex to synchronize with ioctl path */
+ scoped_guard(mutex, &ioc->pci_access_mutex) {
+ ioc->remove_host = 1;
+ }
if (!pci_device_is_present(pdev)) {
mpt3sas_base_pause_mq_polling(ioc);
--
2.25.1