Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
To:     Duoming Zhou <duoming@zju.edu.cn>
Cc:     linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
        jejb@linux.ibm.com, martin.petersen@oracle.com, kuba@kernel.org,
        john.garry@huawei.com, gregkh@linuxfoundation.org,
        davem@davemloft.net
Subject: Re: [PATCH] scsi: libsas: fix use-after-free bug in
 smp_execute_task_sg
From:   "Martin K. Petersen" <martin.petersen@oracle.com>
Organization: Oracle Corporation
Message-ID: <yq15yhbs890.fsf@ca-mkp.ca.oracle.com>
References: <20220920144213.10536-1-duoming@zju.edu.cn>
Date:   Sun, 25 Sep 2022 12:56:44 -0400
In-Reply-To: <20220920144213.10536-1-duoming@zju.edu.cn> (Duoming Zhou's
        message of "Tue, 20 Sep 2022 22:42:13 +0800")
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?sZeET1CjC7MtYzFUP4CC+Ix7OTP7B4s/OS0QQBap2QTw09bxPL2fg/3+TPQ1?=
 =?us-ascii?Q?j0eHAFjIw8NpbxWXe/f4CqObTSCH0/pXssueFVO5tApgaGR+ymRYc+ZY4l+a?=
 =?us-ascii?Q?mAvRT/kOKF23+jBYceEdIAavNaZpY+8NRtqYb1MuKOLJUXVZ8WCH4KVHWB1z?=
 =?us-ascii?Q?HyZ6a/28P+5unT8Gs/CzUUMbTkTliVD2QtQ2w+11smAeYiMcNTjEDaicx+mj?=
 =?us-ascii?Q?dabOnE1/qpMyF9q0ZlpYjtzN4OBhrnVOKycHQv6ubAIriJVCrpZXn/+uzt7m?=
 =?us-ascii?Q?ajJpHafCn3+FiOwBOoLfH5es4UP0+ZGYRMFgEemzs4fCGUM75sJrh8I6zhxP?=
 =?us-ascii?Q?OYlbzngMYsKEKpYOfDfPpyGJKKS2VP+hnCQ/I9Xo7YF4+7RylfQzPRiAWNAS?=
 =?us-ascii?Q?g70ddovQoK4UAEJiFcRCCWZ23Idg8+uXhA7889RjnX6WGJxp3WILZfrMmLcf?=
 =?us-ascii?Q?Q3oN684Elowax9PxYySNQE+lNhRN8hnvW/QEd9guVO1E8Tdb9A+aVJWjh3Wc?=
 =?us-ascii?Q?Ru23N6KHN++uwh1RChm8iwQ2bJe2vARleQ8woxpqPLcsey3U+4EB9DfhR7cO?=
 =?us-ascii?Q?TVN3JU8jke1rM97+LWMQLl8bbtgYkqUM7Yl+T3+tlp3nIJCouMvUVmJ407ZK?=
 =?us-ascii?Q?IeYxgb9oHHD3udZD9bYBvFTdXWj2ZxelMt3HfSVWhW3WTO0lRktwqIQ+nyay?=
 =?us-ascii?Q?OfbgIb74Pe69HETzgvAq032BoN+MDun9ZiU9ttYgIcutPO6s8Sp5WAtTvsYa?=
 =?us-ascii?Q?mAAWMm2Ar+6NCJMrC6bDIXPzEvig8AOwlNXjhgQgcBQkkyFE1kou8K/s5K9j?=
 =?us-ascii?Q?7hDhUh0OxyeooJgLCNT+wjoSP7HeCdhK8JlR4uIYzV3+2kZeS+EkCmsc2Nsj?=
 =?us-ascii?Q?qEwRvrbgVRenL03Lj5SIBA9OBvBts30kYFdhJ0hcgJ/1WX5g2Kiwr/ZHrDEI?=
 =?us-ascii?Q?zkbSFe56X9gpgzgX2M6RusnFdgu90BJ8XRARvDCABVYFDb+Y2DSIXp9zyFPB?=
 =?us-ascii?Q?U5LQGbI8XA0W9TGcLVw1PwuX5snfbjb4OCr/aHTlDPq9ai93bbaUOaYgo4dw?=
 =?us-ascii?Q?k3Uym7Vzg5J5lFvlm79Llgpz7cuYMlbTo0L8jKLkAd0XC+BfJAxJ06b9SbjD?=
 =?us-ascii?Q?pDF9p1qpfcogNIE7jZuZCiFaw1d/im2ouEQFrbkrzpicElQA3+5G8BmbAW/n?=
 =?us-ascii?Q?jRjC1KTxjrGTuh0P8myQpTJQF3C7bHr8bAsM8M1eXh7xTDYNuI4t6G/c2GZR?=
 =?us-ascii?Q?GRp4oTvB0HgLzpPVdda5ft3k/rAuhvpkeJYPPfav3fl8wnZcQt2STC6KY46m?=
 =?us-ascii?Q?1U4WbaCcyFdr1zqqSI067DPWIm09JYxjDFDvpBAb02n/4FU5ZMvNS9/ySl1c?=
 =?us-ascii?Q?azbT9g2G+cW5u4P4nSOLxT7jabTKB1VZUx2OnzPxPuZ+jE9MRrDno/TAg1BC?=
 =?us-ascii?Q?ILYW2W1lfJj9G1gUB1Juapb7XDkkCn2SA1fFvvYjogoEK2FDRvmYaLvIN13G?=
 =?us-ascii?Q?juMObrjT23Q1wQOPuE69GXTc10xI1+lxqD6R2Hr+wTOWIQD1t6PNt/aX74Xj?=
 =?us-ascii?Q?jVA0i5cIEjDIQpP0DAe9vWokARREls5PQVjj6XQoBtkxR7Bgl7qpYqJVoYQy?=
 =?us-ascii?Q?zw=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e01dbf0d-3f08-4c5c-ffc5-08da9f16eef8
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB4759.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Sep 2022 16:56:47.5613
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Ad3YWR2cj22Saw1xBt2M+qV4jsZiAp0DoUa7bwkkwgKFupEfpFkPr81KCTJ/ze36sh4ZKRfGDASDyVD7dBAaUgqpb72lSoh9Y9TBO6Jh1Os=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR10MB5687
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-25_01,2022-09-22_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=595 malwarescore=0
 suspectscore=0 adultscore=0 mlxscore=0 spamscore=0 bulkscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2209130000 definitions=main-2209250123
X-Proofpoint-GUID: -X0yrisCXYCoFcjSYk-SnRqjtVpKuxM-
X-Proofpoint-ORIG-GUID: -X0yrisCXYCoFcjSYk-SnRqjtVpKuxM-
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


Duoming,

> When executing SMP task failed, the smp_execute_task_sg() calls
> del_timer() to delete the "slow_task->timer". However, if the timer
> handler sas_task_internal_timedout() is running, the del_timer() in
> smp_execute_task_sg() will not stop it and the UAF bug will happen.

Applied to 6.1/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering