In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: isci: Fix use-after-free in device removal path<\/p>\n
The ISCI completion tasklet is initialized in isci_host_alloc()
\n(drivers\/scsi\/isci\/init.c:496) and scheduled from both MSI-X and legacy
\ninterrupt handlers (drivers\/scsi\/isci\/host.c:223,613).<\/p>\n
isci_host_deinit() stops the controller and waits for stop completion,
\nbut it never kills completion_tasklet before teardown continues. A
\ntop-of-function tasklet_kill() is not sufficient here: interrupts are
\nonly disabled when isci_host_stop_complete() runs, so until
\nwait_for_stop() returns the IRQ handlers can still requeue the
\ntasklet. The tasklet callback also re-enables interrupts after draining
\ncompletions, so killing the tasklet before the source is quiesced leaves
\nthe same race open.<\/p>\n
Once wait_for_stop() returns, no further IRQ-driven scheduling can
\noccur. Kill completion_tasklet there so teardown cannot race a queued
\ntasklet running on a dead ihost. On remove or unload, the stale callback
\ncan otherwise dereference ihost and touch ihost->smu_registers after the
\nhost lifetime ends.<\/p>\n
A UML + KASAN analogue reproduced the failure class both with no
\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and
\nstayed clean once the kill happened after quiescing the scheduling
\nsource.<\/p>\n
This mirrors commit f6ab594672d4 (“scsi: aic94xx: fix use-after-free in
\ndevice removal path”), but ISCI needs the kill after wait_for_stop().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: isci: Fix use-after-free in device removal path<\/p>\n
The ISCI completion tasklet is initialized in isci_host_alloc()
\n(drivers\/scs<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15075","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}