CVE-2022-50422

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()<br /> <br /> When executing SMP task failed, the smp_execute_task_sg() calls del_timer()<br /> to delete "slow_task-&gt;timer". However, if the timer handler<br /> sas_task_internal_timedout() is running, the del_timer() in<br /> smp_execute_task_sg() will not stop it and a UAF will happen. The process<br /> is shown below:<br /> <br /> (thread 1) | (thread 2)<br /> smp_execute_task_sg() | sas_task_internal_timedout()<br /> ... |<br /> del_timer() |<br /> ... | ...<br /> sas_free_task(task) |<br /> kfree(task-&gt;slow_task) //FREE|<br /> | task-&gt;slow_task-&gt;... //USE<br /> <br /> Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure<br /> the timer handler have finished before the "task-&gt;slow_task" is<br /> deallocated.