On 28/06/2022 01:28, Bart Van Assche wrote:
> How about the patch below (should be sent to the SCSI maintainer)?
>
>
> Subject: [PATCH] scsi: core: Call blk_mq_free_tag_set() earlier
>
> scsi_mq_exit_request() is called by blk_mq_free_tag_set(). Since
> scsi_mq_exit_request() implementations may need resources that are freed
> after scsi_remove_host() has been called and before the host reference
> count drops to zero, call blk_mq_free_tag_set() before the host
> reference count drops to zero. blk_mq_free_tag_set() can be called
> immediately after scsi_forget_host() has returned since scsi_forget_host()
> drains all the request queues that use the host tag set.
>
> This patch fixes the following use-after-free:
>
> ==================================================================
> BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
> Read of size 8 at addr ffff888100337000 by task multipathd/16727
>
> CPU: 0 PID: 16727 Comm: multipathd Not tainted 5.19.0-rc1-roce-flush+ #78
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-27-g64f37cc530f1-prebuilt.qemu.org 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0x34/0x44
> print_report.cold+0x5e/0x5db
> kasan_report+0xab/0x120
> srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
> scsi_mq_exit_request+0x4d/0x70
> blk_mq_free_rqs+0x143/0x410
> __blk_mq_free_map_and_rqs+0x6e/0x100
> blk_mq_free_tag_set+0x2b/0x160
> scsi_host_dev_release+0xf3/0x1a0
> device_release+0x54/0xe0
> kobject_put+0xa5/0x120
> device_release+0x54/0xe0
> kobject_put+0xa5/0x120
> scsi_device_dev_release_usercontext+0x4c1/0x4e0
> execute_in_process_context+0x23/0x90
> device_release+0x54/0xe0
> kobject_put+0xa5/0x120
> scsi_disk_release+0x3f/0x50
> device_release+0x54/0xe0
> kobject_put+0xa5/0x120
> disk_release+0x17f/0x1b0
> device_release+0x54/0xe0
> kobject_put+0xa5/0x120
> dm_put_table_device+0xa3/0x160 [dm_mod]
> dm_put_device+0xd0/0x140 [dm_mod]
> free_priority_group+0xd8/0x110 [dm_multipath]
> free_multipath+0x94/0xe0 [dm_multipath]
> dm_table_destroy+0xa2/0x1e0 [dm_mod]
> __dm_destroy+0x196/0x350 [dm_mod]
> dev_remove+0x10c/0x160 [dm_mod]
> ctl_ioctl+0x2c2/0x590 [dm_mod]
> dm_ctl_ioctl+0x5/0x10 [dm_mod]
> __x64_sys_ioctl+0xb4/0xf0
> dm_ctl_ioctl+0x5/0x10 [dm_mod]
> __x64_sys_ioctl+0xb4/0xf0
> do_syscall_64+0x3b/0x90
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
>
> Reported-by: Li Zhijian <lizhijian@xxxxxxxxxxx>
> Cc: Christoph Hellwig <hch@xxxxxx>
> Cc: Ming Lei <ming.lei@xxxxxxxxxx>
> Cc: John Garry <john.garry@xxxxxxxxxx>
> Fixes: 65ca846a5314 ("scsi: core: Introduce {init,exit}_cmd_priv()")
> Signed-off-by: Bart Van Assche <bvanassche@xxxxxxx>
Awesome, It works for me.
Tested-by: Li Zhijian<lizhijian@xxxxxxxxxxx>
