[PATCH v2] scsi: mpt3sas: Fix use-after-free race in event log access

[PATCH v2] scsi: mpt3sas: Fix use-after-free race in event log access

[Chengfeng Ye]

A use-after-free race exists between ioctl operations accessing the
event log and device removal freeing it. The race occurs because
ioc->remove_host flag is set without synchronization, creating
a window where an ioctl can pass the removal check but still access
freed memory.

Race scenario:

  CPU0 (ioctl)                       CPU1 (device removal)
  ----------------                   ---------------------
  _ctl_ioctl_main()
    mutex_lock(&pci_access_mutex)
    if (!ioc->remove_host)
      [check passes]
                                     scsih_remove()
                                       ioc->remove_host = 1
                                       mpt3sas_ctl_release()
                                         kfree(ioc->event_log)

    _ctl_eventreport()
      copy_to_user(..., ioc->event_log, ...)  <- use-after-free
  mutex_unlock(&pci_access_mutex)

Fix by setting ioc->remove_host while holding pci_access_mutex. This
ensures the ioctl path either completes before removal starts, or sees
the flag and returns -EAGAIN.

Fixes: 6a965ee1892a ("scsi: mpt3sas: Suppress a warning in debug kernel")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 7092d0debef3..973893528747 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -11264,7 +11264,10 @@ static void scsih_remove(struct pci_dev *pdev)
 	if (_scsih_get_shost_and_ioc(pdev, &shost, &ioc))
 		return;
 
-	ioc->remove_host = 1;
+	/* Set remove_host flag under pci_access_mutex to synchronize with ioctl path */
+	scoped_guard(mutex, &ioc->pci_access_mutex) {
+		ioc->remove_host = 1;
+	}
 
 	if (!pci_device_is_present(pdev)) {
 		mpt3sas_base_pause_mq_polling(ioc);
-- 
2.25.1

Re: [PATCH v2] scsi: mpt3sas: Fix use-after-free race in event log access

[Markus Elfring]

…
> ---
>  drivers/scsi/mpt3sas/mpt3sas_scsih.c | 5 ++++-
…

Some contributors would appreciate patch version descriptions.
https://lore.kernel.org/all/?q=%22This+looks+like+a+new+version+of+a+previously+submitted+patch%22
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc5#n310

Regards,
Markus

Re: [PATCH v2] scsi: mpt3sas: Fix use-after-free race in event log access

[Chengfeng Ye]

> Some contributors would appreciate patch version descriptions.
> https://lore.kernel.org/all/?q=%22This+looks+like+a+new+version+of+a+previously+submitted+patch%22
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc5#n310

No problem, resend the patch with the change log included.

Best regards,
Chengfeng