CVE-2022-50422

In the Linux kernel, the following vulnerability has been resolved:

scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()

When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete "slow_task->timer". However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:

  (thread 1)               |        (thread 2)

smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE

Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the "task->slow_task" is deallocated.

The patch replaces del_timer() with del_timer_sync() in smp_execute_task_sg(), ensuring the timeout handler has fully finished before freeing task->slow_task, thereby preventing a use-after-free. Impact is availability only (kernel oops/panic) when SMP task submission fails and races with the timeout path. For the CVSS the PR:H because triggering requires administrative control over SAS devices (issuing SMP tasks via kernel/privileged tooling), typically restricted to root or storage management daemons.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.