lkml.org 
[lkml]   [2022]   [Sep]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] scsi: libsas: fix use-after-free bug in smp_execute_task_sg
From
Date

Duoming,

> When executing SMP task failed, the smp_execute_task_sg() calls
> del_timer() to delete the "slow_task->timer". However, if the timer
> handler sas_task_internal_timedout() is running, the del_timer() in
> smp_execute_task_sg() will not stop it and the UAF bug will happen.

Applied to 6.1/scsi-staging, thanks!

--
Martin K. Petersen Oracle Linux Engineering

\
 
 \ /
  Last update: 2022-09-25 18:57    [W:0.060 / U:0.812 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site