[5.16,213/285] scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()

From: Damien Le Moal <damien.lemoal@opensource.wdc.com>

From: Damien Le Moal <damien.lemoal@opensource.wdc.com>

commit 87d663d40801dffc99a5ad3b0188ad3e2b4d1557 upstream.

The function mpt3sas_transport_port_remove() called in
_scsih_expander_node_remove() frees the port field of the sas_expander
structure, leading to the following use-after-free splat from KASAN when
the ioc_info() call following that function is executed (e.g. when doing
rmmod of the driver module):

[ 3479.371167] ==================================================================
[ 3479.378496] BUG: KASAN: use-after-free in _scsih_expander_node_remove+0x710/0x750 [mpt3sas]
[ 3479.386936] Read of size 1 at addr ffff8881c037691c by task rmmod/1531
[ 3479.393524]
[ 3479.395035] CPU: 18 PID: 1531 Comm: rmmod Not tainted 5.17.0-rc8+ #1436
[ 3479.401712] Hardware name: Supermicro Super Server/H12SSL-NT, BIOS 2.1 06/02/2021
[ 3479.409263] Call Trace:
[ 3479.411743]  <TASK>
[ 3479.413875]  dump_stack_lvl+0x45/0x59
[ 3479.417582]  print_address_description.constprop.0+0x1f/0x120
[ 3479.423389]  ? _scsih_expander_node_remove+0x710/0x750 [mpt3sas]
[ 3479.429469]  kasan_report.cold+0x83/0xdf
[ 3479.433438]  ? _scsih_expander_node_remove+0x710/0x750 [mpt3sas]
[ 3479.439514]  _scsih_expander_node_remove+0x710/0x750 [mpt3sas]
[ 3479.445411]  ? _raw_spin_unlock_irqrestore+0x2d/0x40
[ 3479.452032]  scsih_remove+0x525/0xc90 [mpt3sas]
[ 3479.458212]  ? mpt3sas_expander_remove+0x1d0/0x1d0 [mpt3sas]
[ 3479.465529]  ? down_write+0xde/0x150
[ 3479.470746]  ? up_write+0x14d/0x460
[ 3479.475840]  ? kernfs_find_ns+0x137/0x310
[ 3479.481438]  pci_device_remove+0x65/0x110
[ 3479.487013]  __device_release_driver+0x316/0x680
[ 3479.493180]  driver_detach+0x1ec/0x2d0
[ 3479.498499]  bus_remove_driver+0xe7/0x2d0
[ 3479.504081]  pci_unregister_driver+0x26/0x250
[ 3479.510033]  _mpt3sas_exit+0x2b/0x6cf [mpt3sas]
[ 3479.516144]  __x64_sys_delete_module+0x2fd/0x510
[ 3479.522315]  ? free_module+0xaa0/0xaa0
[ 3479.527593]  ? __cond_resched+0x1c/0x90
[ 3479.532951]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 3479.539607]  ? syscall_enter_from_user_mode+0x21/0x70
[ 3479.546161]  ? trace_hardirqs_on+0x1c/0x110
[ 3479.551828]  do_syscall_64+0x35/0x80
[ 3479.556884]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 3479.563402] RIP: 0033:0x7f1fc482483b
...
[ 3479.943087] ==================================================================

Fix this by introducing the local variable port_id to store the port ID
value before executing mpt3sas_transport_port_remove(). This local variable
is then used in the call to ioc_info() instead of dereferencing the freed
port structure.

Link: https://lore.kernel.org/r/20220322055702.95276-1-damien.lemoal@opensource.wdc.com
Fixes: 7d310f241001 ("scsi: mpt3sas: Get device objects using sas_address & portID")
Cc: stable@vger.kernel.org
Acked-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Message ID	20220412062949.805433258@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Sreekanth Reddy <sreekanth.reddy@broadcom.com>, Damien Le Moal <damien.lemoal@opensource.wdc.com>, "Martin K. Petersen" <martin.petersen@oracle.com> Subject: [PATCH 5.16 213/285] scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove() Date: Tue, 12 Apr 2022 08:31:10 +0200 Message-Id: <20220412062949.805433258@linuxfoundation.org> In-Reply-To: <20220412062943.670770901@linuxfoundation.org> References: <20220412062943.670770901@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.16,002/285] um: fix and optimize xor select template for CONFIG64 and timetravel mode [5.16,004/285] KVM: x86/pmu: Use different raw event masks for AMD and Intel [5.16,009/285] drm: Add orientation quirk for GPD Win Max [5.16,010/285] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 [5.16,012/285] drm/edid: remove non_desktop quirk for HPN-3515 and LEN-B800. [5.16,016/285] drm/amd/display: Use PSR version selected during set_psr_caps [5.16,017/285] usb: gadget: tegra-xudc: Do not program SPARAM [5.16,018/285] usb: gadget: tegra-xudc: Fix control endpoints definitions [5.16,019/285] usb: cdnsp: fix cdnsp_decode_trb function to properly handle ret value [5.16,021/285] selftests, xsk: Fix bpf_res cleanup test [5.16,023/285] drm/amdkfd: Ensure mm remain valid in svm deferred_list work [5.16,024/285] drm/amdkfd: svm range restore work deadlock when process exit [5.16,027/285] ath11k: pci: fix crash on suspend if board file is not found [5.16,028/285] ath11k: mhi: use mhi_sync_power_up() [5.16,029/285] net/smc: Send directly when TCP_CORK is cleared [5.16,030/285] drm/bridge: Add missing pm_runtime_put_sync [5.16,032/285] scsi: mvsas: Replace snprintf() with sysfs_emit() [5.16,033/285] scsi: bfa: Replace snprintf() with sysfs_emit() [5.16,034/285] drm/v3d: fix missing unlock [5.16,035/285] power: supply: axp20x_battery: properly report current when discharging [5.16,036/285] mt76: mt7921: fix crash when startup fails. [5.16,037/285] mt76: dma: initialize skip_unmap in mt76_dma_rx_fill [5.16,039/285] libbpf: Fix build issue with llvm-readelf [5.16,044/285] scsi: smartpqi: Fix rmmod stack trace [5.16,046/285] PCI: aardvark: Fix support for MSI interrupts [5.16,048/285] usb: ehci: add pci device support for Aspeed platforms [5.16,049/285] KVM: arm64: Do not change the PMU event filter after a VCPU has run [5.16,052/285] PCI: pciehp: Add Qualcomm quirk for Command Completed erratum [5.16,053/285] scsi: mpi3mr: Fix reporting of actual data transfer size [5.16,058/285] net/mlx5e: Disable TX queues before registering the netdev [5.16,059/285] usb: dwc3: pci: Set the swnode from inside dwc3_pci_quirks() [5.16,060/285] iwlwifi: mvm: Correctly set fragmented EBS [5.16,061/285] iwlwifi: fix small doc mistake for iwl_fw_ini_addr_val [5.16,062/285] iwlwifi: mvm: move only to an enabled channel [5.16,064/285] rtw89: fix RCU usage in rtw89_core_txq_push() [5.16,067/285] dm: requeue IO if mapping table not yet available [5.16,068/285] drm/amdkfd: make CRAT table missing message informational only [5.16,069/285] vfio/pci: Stub vfio_pci_vga_rw when !CONFIG_VFIO_PCI_VGA [5.16,070/285] scsi: pm8001: Fix pm80xx_pci_mem_copy() interface [5.16,073/285] scsi: pm8001: Fix tag leaks on error [5.16,075/285] mt76: mt7915: fix injected MPDU transmission to not use HW A-MSDU [5.16,076/285] powerpc/64s/hash: Make hash faults work in NMI context [5.16,086/285] Bluetooth: use memset avoid memory leaks [5.16,087/285] bnxt_en: Eliminate unintended link toggle during FW reset [5.16,088/285] PCI: endpoint: Fix misused goto label [5.16,089/285] MIPS: fix fortify panic when copying asm exception handlers [5.16,093/285] can: isotp: set default value for N_As to 50 micro seconds [5.16,095/285] riscv: Fixed misaligned memory access. Fixed pointer comparison. [5.16,097/285] net: limit altnames to 64k total [5.16,099/285] platform/x86: hp-wmi: Fix SW_TABLET_MODE detection method [5.16,100/285] platform/x86: hp-wmi: Fix 0x05 error code reported by several WMI calls [5.16,101/285] net: sfp: add 2500base-X quirk for Lantech SFP module [5.16,106/285] Bluetooth: Fix use after free in hci_send_acl [5.16,107/285] netfilter: conntrack: revisit gc autotuning [5.16,110/285] ceph: fix memory leak in ceph_readdir when note_last_dentry returns error [5.16,112/285] init/main.c: return 1 from handled __setup() functions [5.16,114/285] clk: si5341: fix reported clk_rate when output divider is 2 [5.16,121/285] clk: rockchip: drop CLK_SET_RATE_PARENT from dclk_vop* on rk3568 [5.16,125/285] w1: w1_therm: fixes w1_seq for ds28ea00 sensors [5.16,126/285] NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() [5.16,127/285] NFSv4: Protect the state recovery thread against direct reclaim [5.16,128/285] habanalabs: fix possible memory leak in MMU DR fini [5.16,130/285] xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 [5.16,131/285] clk: ti: Preserve node in ti_dt_clocks_register() [5.16,133/285] SUNRPC/xprt: async tasks mustnt block waiting for memory [5.16,135/285] NFS: swap IO handling is slightly different for O_DIRECT IO [5.16,137/285] x86: Annotate call_on_stack() [5.16,139/285] serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() [5.16,143/285] NFS: nfsiod should not block forever in mempool_alloc() [5.16,144/285] NFS: Avoid writeback threads getting stuck in mempool_alloc() [5.16,146/285] parisc: Fix CPU affinity for Lasi, WAX and Dino chips [5.16,148/285] mm: fix race between MADV_FREE reclaim and blkdev direct IO read [5.16,150/285] rtc: Check return value from mc146818_get_time() [5.16,152/285] drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() [5.16,154/285] Revert "NFSv4: Handle the special Linux file open access mode" [5.16,155/285] NFSv4: fix open failure with O_ACCMODE flag [5.16,157/285] scsi: core: Fix sbitmap depth in scsi_realloc_sdev_budget_map() [5.16,158/285] scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() [5.16,160/285] net: sfc: add missing xdp queue reinitialization [5.16,161/285] net/tls: fix slab-out-of-bounds bug in decrypt_internal [5.16,164/285] ice: Clear default forwarding VSI during VSI release [5.16,165/285] mctp: Fix check for dev_hard_header() result [5.16,167/285] net: ipv4: fix route with nexthop object delete warning [5.16,168/285] net: stmmac: Fix unset max_speed difference between DT and non-DT platforms [5.16,171/285] drm/imx: dw_hdmi-imx: Fix bailout in error cases of probe [5.16,173/285] regulator: atc260x: Fix missing active_discharge_on setting [5.16,174/285] arch/arm64: Fix topology initialization for core scheduling [5.16,176/285] bnxt_en: reserve space inside receive page for skb_shared_info [5.16,178/285] sfc: Do not free an empty page_ring [5.16,180/285] RDMA/mlx5: Add a missing update of cache->last_add [5.16,181/285] IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD [5.16,183/285] sctp: count singleton chunks in assoc user stats [5.16,185/285] ice: Set txq_teid to ICE_INVAL_TEID on ring creation [5.16,187/285] ipv6: Fix stats accounting in ip6_pkt_drop [5.16,188/285] ice: synchronize_rcu() when terminating rings [5.16,190/285] ice: clear cmd_type_offset_bsz for TX rings [5.16,193/285] net: openvswitch: fix leak of nested actions [5.16,194/285] rxrpc: fix a race in rxrpc_exit_net() [5.16,195/285] net: sfc: fix using uninitialized xdp tx_queue [5.16,200/285] drbd: Fix five use after free bugs in get_initial_state [5.16,206/285] SUNRPC: Handle low memory situations in call_status() [5.16,208/285] iommu/omap: Fix regression in probe for NULL pointer dereference [5.16,213/285] scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove() [5.16,214/285] scsi: ufs: ufs-pci: Add support for Intel MTL [5.16,215/285] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" [5.16,219/285] mmc: core: Fixup support for writeback-cache for eMMC and SD [5.16,220/285] lz4: fix LZ4_decompress_safe_partial read out of bound [5.16,222/285] mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) [5.16,223/285] mm/mempolicy: fix mpol_new leak in shared_policy_replace [5.16,226/285] io_uring: implement compat handling for IORING_REGISTER_IOWQ_AFF [5.16,228/285] x86/pm: Save the MSR validity status at context setup [5.16,229/285] x86/speculation: Restore speculation related MSRs during S3 resume [5.16,233/285] btrfs: remove device item and update super block in the same transaction [5.16,234/285] btrfs: avoid defragging extents whose next extents are not targets [5.16,235/285] btrfs: prevent subvol with swapfile from being deleted [5.16,236/285] spi: core: add dma_map_dev for __spi_unmap_msg() [5.16,237/285] qed: fix ethtool register dump [5.16,240/285] drbd: fix an invalid memory access caused by incorrect use of list iterator [5.16,241/285] gpio: Restrict usage of GPIO chip irq members before initialization [5.16,245/285] ata: sata_dwc_460ex: Fix crash due to OOB write [5.16,247/285] perf/core: Inherit event_caps [5.16,249/285] fbdev: Fix unregistering of framebuffers without device [5.16,255/285] drm/amdgpu/vcn: Fix the register setting for vcn1 [5.16,258/285] drm/amdgpu: dont use BACO for reset in S3 [5.16,259/285] SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() [5.16,260/285] KVM: SVM: Allow AVIC support on system w/ physical APIC ID > 255 [5.16,262/285] net/smc: send directly on setting TCP_NODELAY [5.16,263/285] Revert "selftests: net: Add tls config dependency for tls selftests" [5.16,265/285] selftests/bpf: Fix u8 narrow load checks for bpf_sk_lookup remote_port [5.16,266/285] rtc: mc146818-lib: fix signedness bug in mc146818_get_time() [5.16,267/285] perf build: Dont use -ffat-lto-objects in the python feature test when building wi... [5.16,269/285] tools build: Filter out options and warnings not supported by clang [5.16,270/285] tools build: Use $(shell ) instead of `` to get embedded libperls ccopts [5.16,271/285] dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" [5.16,274/285] x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation [5.16,276/285] powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit [5.16,278/285] x86/bug: Prevent shadowing in __WARN_FLAGS [5.16,279/285] sched: Teach the forced-newidle balancer about CPU affinity limitation. [5.16,281/285] irqchip/gic-v4: Wait for GICR_VPENDBASER.Dirty to clear before descheduling [5.16,283/285] irqchip/gic, gic-v3: Prevent GSI to SGI translations [5.16,284/285] mm/sparsemem: fix mem_section will never be NULL gcc 12 warning

[5.16,213/285] scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()

Commit Message

Patch