Commit f6ab5946 authored by Junrui Luo's avatar Junrui Luo Committed by Martin K. Petersen
Browse files

scsi: aic94xx: fix use-after-free in device removal path 



The asd_pci_remove() function fails to synchronize with pending tasklets
before freeing the asd_ha structure, leading to a potential
use-after-free vulnerability.

When a device removal is triggered (via hot-unplug or module unload),
race condition can occur.

The fix adds tasklet_kill() before freeing the asd_ha structure,
ensuring all scheduled tasklets complete before cleanup proceeds.

Reported-by: default avatarYuhao Jiang <danisjiang@gmail.com>
Reported-by: default avatarJunrui Luo <moonafterrain@outlook.com>
Fixes: 2908d778 ("[SCSI] aic94xx: new driver")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJunrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/ME2PR01MB3156AB7DCACA206C845FC7E8AFFDA@ME2PR01MB3156.ausprd01.prod.outlook.com


Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent d204087a

drivers/scsi/aic94xx/aic94xx_init.c

+3 −0
Original line number Diff line number Diff line
@@ -882,6 +882,9 @@ static void asd_pci_remove(struct pci_dev *dev) 


	asd_disable_ints(asd_ha);



	/* Ensure all scheduled tasklets complete before freeing resources */

	tasklet_kill(&asd_ha->seq.dl_tasklet);



	asd_remove_dev_attrs(asd_ha);



	/* XXX more here as needed */