| From 1e95c798d8a7f70965f0f88d4657b682ff0ec75f Mon Sep 17 00:00:00 2001 |
| From: Guixin Liu <kanie@linux.alibaba.com> |
| Date: Wed, 18 Dec 2024 09:42:14 +0800 |
| Subject: scsi: ufs: bsg: Set bsg_queue to NULL after removal |
| |
| From: Guixin Liu <kanie@linux.alibaba.com> |
| |
| commit 1e95c798d8a7f70965f0f88d4657b682ff0ec75f upstream. |
| |
| Currently, this does not cause any issues, but I believe it is necessary to |
| set bsg_queue to NULL after removing it to prevent potential use-after-free |
| (UAF) access. |
| |
| Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> |
| Link: https://lore.kernel.org/r/20241218014214.64533-3-kanie@linux.alibaba.com |
| Reviewed-by: Avri Altman <avri.altman@wdc.com> |
| Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
| Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> |
| Signed-off-by: He Zhe <zhe.he@windriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/scsi/ufs/ufs_bsg.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/scsi/ufs/ufs_bsg.c |
| +++ b/drivers/scsi/ufs/ufs_bsg.c |
| @@ -175,6 +175,7 @@ void ufs_bsg_remove(struct ufs_hba *hba) |
| return; |
| |
| bsg_remove_queue(hba->bsg_queue); |
| + hba->bsg_queue = NULL; |
| |
| device_del(bsg_dev); |
| put_device(bsg_dev); |
