Re: [PATCH] scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()

[Douglas Gilbert <dgilbert@xxxxxxxxxxxx>]

On 2022-11-17 03:44, Yuan Can wrote:
> If device_register() fails in sdebug_add_host_helper(), it will goto clean
> and sdbg_host will be freed, but sdbg_host->host_list will not be removed
> from sdebug_host_list, then list traversal may cause UAF, fix it.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Yuan Can <yuancan@xxxxxxxxxx>

Acked-by: Douglas Gilbert <dgilbert@xxxxxxxxxxxx>

Thanks.

> ---
>   drivers/scsi/scsi_debug.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
> index 629853662b82..bebda917b138 100644
> --- a/drivers/scsi/scsi_debug.c
> +++ b/drivers/scsi/scsi_debug.c
> @@ -7323,8 +7323,12 @@ static int sdebug_add_host_helper(int per_host_idx)
>   	dev_set_name(&sdbg_host->dev, "adapter%d", sdebug_num_hosts);
>   
>   	error = device_register(&sdbg_host->dev);
> -	if (error)
> +	if (error) {
> +		spin_lock(&sdebug_host_list_lock);
> +		list_del(&sdbg_host->host_list);
> +		spin_unlock(&sdebug_host_list_lock);
>   		goto clean;
> +	}
>   
>   	++sdebug_num_hosts;
>   	return 0;