Messages in this thread | | | Subject | Re: [PATCH] scsi: libsas: fix use-after-free bug in smp_execute_task_sg | From | "Martin K. Petersen" <> | Date | Sun, 25 Sep 2022 12:56:44 -0400 |
| |
Duoming,
> When executing SMP task failed, the smp_execute_task_sg() calls > del_timer() to delete the "slow_task->timer". However, if the timer > handler sas_task_internal_timedout() is running, the del_timer() in > smp_execute_task_sg() will not stop it and the UAF bug will happen.
Applied to 6.1/scsi-staging, thanks!
-- Martin K. Petersen Oracle Linux Engineering
| |