CVE-2022-48666

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: core: Fix a use-after-free<br /> <br /> There are two .exit_cmd_priv implementations. Both implementations use<br /> resources associated with the SCSI host. Make sure that these resources are<br /> still available when .exit_cmd_priv is called by waiting inside<br /> scsi_remove_host() until the tag set has been freed.<br /> <br /> This commit fixes the following use-after-free:<br /> <br /> ==================================================================<br /> BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]<br /> Read of size 8 at addr ffff888100337000 by task multipathd/16727<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x34/0x44<br /> print_report.cold+0x5e/0x5db<br /> kasan_report+0xab/0x120<br /> srp_exit_cmd_priv+0x27/0xd0 [ib_srp]<br /> scsi_mq_exit_request+0x4d/0x70<br /> blk_mq_free_rqs+0x143/0x410<br /> __blk_mq_free_map_and_rqs+0x6e/0x100<br /> blk_mq_free_tag_set+0x2b/0x160<br /> scsi_host_dev_release+0xf3/0x1a0<br /> device_release+0x54/0xe0<br /> kobject_put+0xa5/0x120<br /> device_release+0x54/0xe0<br /> kobject_put+0xa5/0x120<br /> scsi_device_dev_release_usercontext+0x4c1/0x4e0<br /> execute_in_process_context+0x23/0x90<br /> device_release+0x54/0xe0<br /> kobject_put+0xa5/0x120<br /> scsi_disk_release+0x3f/0x50<br /> device_release+0x54/0xe0<br /> kobject_put+0xa5/0x120<br /> disk_release+0x17f/0x1b0<br /> device_release+0x54/0xe0<br /> kobject_put+0xa5/0x120<br /> dm_put_table_device+0xa3/0x160 [dm_mod]<br /> dm_put_device+0xd0/0x140 [dm_mod]<br /> free_priority_group+0xd8/0x110 [dm_multipath]<br /> free_multipath+0x94/0xe0 [dm_multipath]<br /> dm_table_destroy+0xa2/0x1e0 [dm_mod]<br /> __dm_destroy+0x196/0x350 [dm_mod]<br /> dev_remove+0x10c/0x160 [dm_mod]<br /> ctl_ioctl+0x2c2/0x590 [dm_mod]<br /> dm_ctl_ioctl+0x5/0x10 [dm_mod]<br /> __x64_sys_ioctl+0xb4/0xf0<br /> dm_ctl_ioctl+0x5/0x10 [dm_mod]<br /> __x64_sys_ioctl+0xb4/0xf0<br /> do_syscall_64+0x3b/0x90<br /> entry_SYSCALL_64_after_hwframe+0x46/0xb0