From: Greg Kroah-Hartman Date: Mon, 1 Apr 2024 09:08:27 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v6.7.12~73 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=015584e37ff9e2781719a2bd2af36f4274239744;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: scsi-core-fix-unremoved-procfs-host-directory-regression.patch --- diff --git a/queue-5.4/scsi-core-fix-unremoved-procfs-host-directory-regression.patch b/queue-5.4/scsi-core-fix-unremoved-procfs-host-directory-regression.patch new file mode 100644 index 00000000000..cb783f2dd85 --- /dev/null +++ b/queue-5.4/scsi-core-fix-unremoved-procfs-host-directory-regression.patch @@ -0,0 +1,80 @@ +From f23a4d6e07570826fe95023ca1aa96a011fa9f84 Mon Sep 17 00:00:00 2001 +From: "Guilherme G. Piccoli" +Date: Wed, 13 Mar 2024 08:21:20 -0300 +Subject: scsi: core: Fix unremoved procfs host directory regression + +From: Guilherme G. Piccoli + +commit f23a4d6e07570826fe95023ca1aa96a011fa9f84 upstream. + +Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} +directory earlier") fixed a bug related to modules loading/unloading, by +adding a call to scsi_proc_hostdir_rm() on scsi_remove_host(). But that led +to a potential duplicate call to the hostdir_rm() routine, since it's also +called from scsi_host_dev_release(). That triggered a regression report, +which was then fixed by commit be03df3d4bfe ("scsi: core: Fix a procfs host +directory removal regression"). The fix just dropped the hostdir_rm() call +from dev_release(). + +But it happens that this proc directory is created on scsi_host_alloc(), +and that function "pairs" with scsi_host_dev_release(), while +scsi_remove_host() pairs with scsi_add_host(). In other words, it seems the +reason for removing the proc directory on dev_release() was meant to cover +cases in which a SCSI host structure was allocated, but the call to +scsi_add_host() didn't happen. And that pattern happens to exist in some +error paths, for example. + +Syzkaller causes that by using USB raw gadget device, error'ing on +usb-storage driver, at usb_stor_probe2(). By checking that path, we can see +that the BadDevice label leads to a scsi_host_put() after a SCSI host +allocation, but there's no call to scsi_add_host() in such path. That leads +to messages like this in dmesg (and a leak of the SCSI host proc +structure): + +usb-storage 4-1:87.51: USB Mass Storage device detected +proc_dir_entry 'scsi/usb-storage' already registered +WARNING: CPU: 1 PID: 3519 at fs/proc/generic.c:377 proc_register+0x347/0x4e0 fs/proc/generic.c:376 + +The proper fix seems to still call scsi_proc_hostdir_rm() on dev_release(), +but guard that with the state check for SHOST_CREATED; there is even a +comment in scsi_host_dev_release() detailing that: such conditional is +meant for cases where the SCSI host was allocated but there was no calls to +{add,remove}_host(), like the usb-storage case. + +This is what we propose here and with that, the error path of usb-storage +does not trigger the warning anymore. + +Reported-by: syzbot+c645abf505ed21f931b5@syzkaller.appspotmail.com +Fixes: be03df3d4bfe ("scsi: core: Fix a procfs host directory removal regression") +Cc: stable@vger.kernel.org +Cc: Bart Van Assche +Cc: John Garry +Cc: Shin'ichiro Kawasaki +Signed-off-by: Guilherme G. Piccoli +Link: https://lore.kernel.org/r/20240313113006.2834799-1-gpiccoli@igalia.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/hosts.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -331,12 +331,13 @@ static void scsi_host_dev_release(struct + + if (shost->shost_state == SHOST_CREATED) { + /* +- * Free the shost_dev device name here if scsi_host_alloc() +- * and scsi_host_put() have been called but neither ++ * Free the shost_dev device name and remove the proc host dir ++ * here if scsi_host_{alloc,put}() have been called but neither + * scsi_host_add() nor scsi_host_remove() has been called. + * This avoids that the memory allocated for the shost_dev +- * name is leaked. ++ * name as well as the proc dir structure are leaked. + */ ++ scsi_proc_hostdir_rm(shost->hostt); + kfree(dev_name(&shost->shost_dev)); + } + diff --git a/queue-5.4/series b/queue-5.4/series index a7f2dddfe88..db99de85db7 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -116,3 +116,4 @@ mmc-core-initialize-mmc_blk_ioc_data.patch mmc-core-avoid-negative-index-with-array-access.patch usb-cdc-wdm-close-race-between-read-and-workqueue.patch alsa-sh-aica-reorder-cleanup-operations-to-avoid-uaf-bugs.patch +scsi-core-fix-unremoved-procfs-host-directory-regression.patch