[PATCH 6.1.y] scsi: sg: Fix slab-use-after-free read in sg_release()

[PATCH 6.1.y] scsi: sg: Fix slab-use-after-free read in sg_release()

[alvalan9]

From: Suraj Sonawane <surajsonawane0215@gmail.com>

commit f10593ad9bc36921f623361c9e3dd96bd52d85ee upstream.

Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:

BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30
kernel/locking/lockdep.c:5838
__mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912
sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407

In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is
called before releasing the open_rel_lock mutex. The kref_put() call may
decrement the reference count of sfp to zero, triggering its cleanup
through sg_remove_sfp(). This cleanup includes scheduling deferred work
via sg_remove_sfp_usercontext(), which ultimately frees sfp.

After kref_put(), sg_release() continues to unlock open_rel_lock and may
reference sfp or sdp. If sfp has already been freed, this results in a
slab-use-after-free error.

Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the
open_rel_lock mutex. This ensures:

 - No references to sfp or sdp occur after the reference count is
   decremented.

 - Cleanup functions such as sg_remove_sfp() and
   sg_remove_sfp_usercontext() can safely execute without impacting the
   mutex handling in sg_release().

The fix has been tested and validated by syzbot. This patch closes the
bug reported at the following syzkaller link and ensures proper
sequencing of resource cleanup and mutex operations, eliminating the
risk of use-after-free errors in sg_release().

Reported-by: syzbot+7efb5850a17ba6ce098b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7efb5850a17ba6ce098b
Tested-by: syzbot+7efb5850a17ba6ce098b@syzkaller.appspotmail.com
Fixes: cc833acbee9d ("sg: O_EXCL and other lock handling")
Signed-off-by: Suraj Sonawane <surajsonawane0215@gmail.com>
Link: https://lore.kernel.org/r/20241120125944.88095-1-surajsonawane0215@gmail.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Alva Lan <alvalan9@foxmail.com>
---
 drivers/scsi/sg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 12344be14232..1946cc96c172 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -390,7 +390,6 @@ sg_release(struct inode *inode, struct file *filp)
 
 	mutex_lock(&sdp->open_rel_lock);
 	scsi_autopm_put_device(sdp->device);
-	kref_put(&sfp->f_ref, sg_remove_sfp);
 	sdp->open_cnt--;
 
 	/* possibly many open()s waiting on exlude clearing, start many;
@@ -402,6 +401,7 @@ sg_release(struct inode *inode, struct file *filp)
 		wake_up_interruptible(&sdp->open_wait);
 	}
 	mutex_unlock(&sdp->open_rel_lock);
+	kref_put(&sfp->f_ref, sg_remove_sfp);
 	return 0;
 }
 
-- 
2.43.0

Re: [PATCH 6.1.y] scsi: sg: Fix slab-use-after-free read in sg_release()

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: f10593ad9bc36921f623361c9e3dd96bd52d85ee

WARNING: Author mismatch between patch and upstream commit:
Backport author: alvalan9@foxmail.com
Commit author: Suraj Sonawane<surajsonawane0215@gmail.com>


Status in newer kernel trees:
6.12.y | Present (different SHA1: 1f5e2f1ca587)
6.6.y | Present (different SHA1: 59b30afa5786)
6.1.y | Not found

Note: The patch differs from the upstream commit:
---
1:  f10593ad9bc3 ! 1:  7c77aeeb186d scsi: sg: Fix slab-use-after-free read in sg_release()
    @@ Metadata
      ## Commit message ##
         scsi: sg: Fix slab-use-after-free read in sg_release()
     
    +    commit f10593ad9bc36921f623361c9e3dd96bd52d85ee upstream.
    +
         Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:
     
         BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30
    @@ Commit message
         Link: https://lore.kernel.org/r/20241120125944.88095-1-surajsonawane0215@gmail.com
         Reviewed-by: Bart Van Assche <bvanassche@acm.org>
         Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    +    Signed-off-by: Alva Lan <alvalan9@foxmail.com>
     
      ## drivers/scsi/sg.c ##
     @@ drivers/scsi/sg.c: sg_release(struct inode *inode, struct file *filp)
    - 	SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, "sg_release\n"));
      
      	mutex_lock(&sdp->open_rel_lock);
    + 	scsi_autopm_put_device(sdp->device);
     -	kref_put(&sfp->f_ref, sg_remove_sfp);
      	sdp->open_cnt--;
      
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |