kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Haoran Zhang ace9c778a2 vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() 
commit 221af82f60 upstream.

Since commit 3f8ca2e115 ("vhost/scsi: Extract common handling code
from control queue handler") a null pointer dereference bug can be
triggered when guest sends an SCSI AN request.

In vhost_scsi_ctl_handle_vq(), `vc.target` is assigned with
`&v_req.tmf.lun[1]` within a switch-case block and is then passed to
vhost_scsi_get_req() which extracts `vc->req` and `tpg`. However, for
a `VIRTIO_SCSI_T_AN_*` request, tpg is not required, so `vc.target` is
set to NULL in this branch. Later, in vhost_scsi_get_req(),
`vc->target` is dereferenced without being checked, leading to a null
pointer dereference bug. This bug can be triggered from guest.

When this bug occurs, the vhost_worker process is killed while holding
`vq->mutex` and the corresponding tpg will remain occupied
indefinitely.

Below is the KASAN report:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 840 Comm: poc Not tainted 6.10.0+ #1
Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:vhost_scsi_get_req+0x165/0x3a0
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 02 00 00
48 b8 00 00 00 00 00 fc ff df 4d 8b 65 30 4c 89 e2 48 c1 ea 03 <0f> b6
04 02 4c 89 e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 be 01 00 00
RSP: 0018:ffff888017affb50 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88801b000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017affcb8
RBP: ffff888017affb80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888017affc88 R14: ffff888017affd1c R15: ffff888017993000
FS:  000055556e076500(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200027c0 CR3: 0000000010ed0004 CR4: 0000000000370ef0
Call Trace:
 <TASK>
 ? show_regs+0x86/0xa0
 ? die_addr+0x4b/0xd0
 ? exc_general_protection+0x163/0x260
 ? asm_exc_general_protection+0x27/0x30
 ? vhost_scsi_get_req+0x165/0x3a0
 vhost_scsi_ctl_handle_vq+0x2a4/0xca0
 ? __pfx_vhost_scsi_ctl_handle_vq+0x10/0x10
 ? __switch_to+0x721/0xeb0
 ? __schedule+0xda5/0x5710
 ? __kasan_check_write+0x14/0x30
 ? _raw_spin_lock+0x82/0xf0
 vhost_scsi_ctl_handle_kick+0x52/0x90
 vhost_run_work_list+0x134/0x1b0
 vhost_task_fn+0x121/0x350
...
 </TASK>
---[ end trace 0000000000000000 ]---

Let's add a check in vhost_scsi_get_req.

Fixes: 3f8ca2e115 ("vhost/scsi: Extract common handling code from control queue handler")
Signed-off-by: Haoran Zhang <wh1sper@zju.edu.cn>
[whitespace fixes]
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Message-Id: <b26d7ddd-b098-4361-88f8-17ca7f90adf7@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-10-17 15:22:09 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:02:55 +02:00
acpi ACPI: battery: Fix possible crash when unregistering a battery hook 2024-10-17 15:22:08 +02:00
amba amba: bus: fix refcount leak 2023-09-13 09:42:56 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:10:26 +02:00
ata ata: sata_sil: Rename sil_blacklist to sil_quirks 2024-10-17 15:21:43 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-29 17:30:24 +02:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:49:51 +02:00
base firmware_loader: Block path traversal 2024-10-17 15:21:20 +02:00
bcma Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
block aoe: fix the potential use-after-free problem in more places 2024-10-17 15:21:58 +02:00
bluetooth Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122 2024-10-17 15:21:37 +02:00
bus bus: mhi: host: pci_generic: Fix the name for the Telit FE990A 2024-10-17 15:21:20 +02:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:47:10 +02:00
char hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume 2024-10-17 15:21:23 +02:00
clk clk: qcom: gcc-sc8180x: Add GPLL9 support 2024-10-17 15:22:08 +02:00
clocksource clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() 2024-10-17 15:20:47 +02:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-27 17:07:14 +02:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter counter: ti-eqep: enable clock at probe 2024-07-05 09:31:53 +02:00
cpufreq cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock 2024-10-17 15:22:03 +02:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:04:54 +02:00
crypto crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure 2024-10-17 15:21:20 +02:00
cxl cxl/pci: Fix to record only non-zero ranges 2024-10-17 15:21:12 +02:00
dax dax/kmem: Pass valid argument to memory_group_register_static 2023-07-19 16:21:43 +02:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:12:47 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:32:38 +01:00
dma dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor 2024-09-08 07:53:11 +02:00
dma-buf dma-buf: heaps: Fix off-by-one in CMA heap fault handler 2024-09-18 19:23:06 +02:00
edac EDAC/igen6: Fix conversion of system address to physical memory address 2024-10-17 15:21:23 +02:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:03:41 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:56:16 +02:00
firmware firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() 2024-10-17 15:21:51 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-12 11:03:39 +02:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-13 09:42:54 +02:00
gnss gnss: replace ida_simple API 2022-06-21 09:30:36 +02:00
gpio gpio: davinci: fix lazy disable 2024-10-17 15:22:02 +02:00
gpu drm/amd/display: Allow backlight to go below AMDGPU_DM_DEFAULT_MIN_BACKLIGHT 2024-10-17 15:22:05 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:36:00 +02:00
hid HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio 2024-10-17 15:21:45 +02:00
hsi HSI: omap_ssi_core: Fix error handling in ssi_init() 2022-12-31 13:32:45 +01:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:51:58 +01:00
hv Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:10:26 +02:00
hwmon hwmon: (ntc_thermistor) fix module autoloading 2024-10-17 15:20:48 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:53:09 +02:00
hwtracing coresight: tmc: sg: Do not leak sg_table 2024-10-17 15:21:11 +02:00
i2c i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled 2024-10-17 15:22:04 +02:00
i3c i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup 2024-09-12 11:10:24 +02:00
idle intel_idle: add Emerald Rapids Xeon support 2023-10-10 22:00:44 +02:00
iio iio: magnetometer: ak8975: Fix reading for ak099xx sensors 2024-10-17 15:22:00 +02:00
infiniband RDMA/irdma: fix error message in irdma_modify_qp_roce() 2024-10-17 15:21:08 +02:00
input Input: adp5589-keys - fix adp5589_gpio_get_value() 2024-10-17 15:22:01 +02:00
interconnect interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID 2024-08-03 08:49:19 +02:00
iommu iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count 2024-10-17 15:21:42 +02:00
ipack Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
irqchip irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 2024-09-12 11:10:19 +02:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-03 08:49:50 +02:00
leds leds: spi-byte: Call of_node_put() on error path 2024-09-12 11:10:19 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:49:22 +02:00
mailbox mailbox: bcm2835: Fix timeout during suspend mode 2024-10-17 15:21:30 +02:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:07:13 +00:00
md Revert "dm: requeue IO if mapping table not yet available" 2024-10-17 15:21:12 +02:00
media media: imx335: Fix reset-gpio handling 2024-10-17 15:22:06 +02:00
memory memory: stm32-fmc2-ebi: check regmap_read return value 2024-08-29 17:30:36 +02:00
memstick memstick r592: make memstick_debug_get_tpc_name() static 2023-07-19 16:21:08 +02:00
message scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition 2023-05-24 17:32:37 +01:00
mfd mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-03 08:49:15 +02:00
misc eeprom: digsy_mtc: Fix 93xx46 driver probe failure 2024-09-18 19:23:04 +02:00
mmc mmc: cqhci: Fix checking of CQHCI_HALT state 2024-09-12 11:10:17 +02:00
most most: usb: replace snprintf in show functions with sysfs_emit 2021-11-26 17:03:47 +01:00
mtd mtd: rawnand: mtk: Fix init error path 2024-10-17 15:20:50 +02:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net r8169: add tally counter fields added with RTL8125 2024-10-17 15:22:07 +02:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:25:02 +02:00
ntb ntb: Force physically contiguous allocation of rx ring buffers 2024-10-17 15:21:08 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:27:37 +01:00
nvdimm nvdimm: Fix devs leaks in scan_labels() 2024-10-17 15:21:04 +02:00
nvme nvme-pci: qdepth 1 quirk 2024-10-17 15:21:37 +02:00
nvmem nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc 2024-09-12 11:10:26 +02:00
of of/irq: Support #msi-cells=<0> in of_msi_get_domain 2024-10-17 15:21:55 +02:00
opp OPP: ti: Fix ti_opp_supply_probe wrong return values 2024-08-03 08:48:58 +02:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:16:59 -08:00
parport dev/parport: fix the array out-of-bounds risk 2024-08-03 08:49:37 +02:00
pci PCI/PM: Mark devices disconnected if upstream PCIe link is down on resume 2024-10-17 15:21:28 +02:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:10:20 +02:00
peci peci: cpu: Fix use-after-free in adev_release() 2022-08-15 20:31:35 +02:00
perf perf/arm-cmn: Fail DTC counter allocation correctly 2024-10-17 15:21:28 +02:00
phy phy: zynqmp: Take the phy mutex in xlate 2024-09-12 11:10:22 +02:00
pinctrl pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function 2024-10-17 15:21:06 +02:00
platform platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug 2024-10-17 15:21:50 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:12:47 +00:00
power power: supply: hwmon: Fix missing temp1_max_alarm attribute 2024-10-17 15:21:51 +02:00
powercap powercap: RAPL: fix invalid initialization for pl4_supported field 2024-09-30 16:23:56 +02:00
pps pps: add an error check in parport_attach 2024-10-17 15:21:26 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: fix integer overflow in max_vclocks_store 2024-06-27 13:46:19 +02:00
pwm pwm: atmel-tcb: Fix race condition and convert to guards 2024-08-03 08:48:55 +02:00
rapidio rapidio: devices: fix missing put_device in mport_cdev_open 2022-12-31 13:32:00 +01:00
ras RAS/CEC: Reduce offline page threshold for Intel systems 2022-08-22 19:30:02 +02:00
regulator regulator: Return actual error in of_regulator_bulk_get_all() 2024-10-17 15:20:45 +02:00
remoteproc remoteproc: k3-r5: Delay notification of wakeup event 2024-10-17 15:22:06 +02:00
reset reset: k210: fix OF node leak in probe() error path 2024-10-17 15:20:47 +02:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-01-31 16:16:59 -08:00
rtc rtc: at91sam9: fix OF node leak in probe() error path 2024-10-17 15:22:01 +02:00
s390 Revert "s390/dasd: Establish DMA alignment" 2024-08-29 17:30:54 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers 2024-10-17 15:21:47 +02:00
sh genirq: Add and use an irq_data_update_affinity helper 2022-07-07 09:38:04 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 11:56:20 +02:00
soc soc: versatile: realview: fix soc_dev leak during device remove 2024-10-17 15:21:24 +02:00
soundwire soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" 2024-09-18 19:23:06 +02:00
spi spi: bcm63xx: Fix missing pm_runtime_disable() 2024-10-17 15:22:04 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:35:55 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:30:27 +02:00
staging minmax: reduce min/max macro expansion in atomisp driver 2024-09-18 19:23:04 +02:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-05-17 11:56:07 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: ffa: Fix missing-field-initializers warning 2024-07-25 09:49:17 +02:00
thermal thermal: of: Fix OF node leak in of_thermal_zone_find() error paths 2024-09-04 13:24:59 +02:00
thunderbolt thunderbolt: Mark XDomain as unplugged when router is removed 2024-08-29 17:30:13 +02:00
tty tty: rp2: Fix reset with non forgiving PCIe host bridges 2024-10-17 15:21:20 +02:00
ufs scsi: ufs: core: Bypass quick recovery if force reset is needed 2024-09-08 07:52:59 +02:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:10:26 +02:00
usb usb: yurex: Fix inconsistent locking bug in yurex_read() 2024-10-17 15:21:28 +02:00
vdpa vduse: Temporarily fail if control queue feature requested 2024-07-05 09:31:48 +02:00
vfio vfio/pci: fix potential memory leak in vfio_intx_enable() 2024-10-17 15:21:15 +02:00
vhost vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() 2024-10-17 15:22:09 +02:00
video fbdev: pxafb: Fix possible use after free in pxafb_task() 2024-10-17 15:21:42 +02:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-12 11:03:30 +02:00
virtio vdpa: Add eventfd for the vdpa callback 2024-10-17 15:21:12 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 w1: fix loop in w1_fini() 2023-07-19 16:21:48 +02:00
watchdog watchdog: imx_sc_wdt: Don't disable WDT in suspend 2024-10-17 15:21:06 +02:00
xen xen/swiotlb: fix allocated size 2024-10-17 15:20:55 +02:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig vme: move back to staging 2022-06-10 15:38:14 +02:00
Makefile hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00