* [PATCH] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent
@ 2021-12-20 11:39 lixiaokeng
2021-12-20 19:54 ` michael.christie
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: lixiaokeng @ 2021-12-20 11:39 UTC (permalink / raw)
To: lduncan, cleech, linux-scsi; +Cc: linfeilong
|- iscsi_if_destroy_conn |-dev_attr_show
|-iscsi_conn_teardown
|-spin_lock_bh |-iscsi_sw_tcp_conn_get_param
|-kfree(conn->persistent_address) |-iscsi_conn_get_param
|-kfree(conn->local_ipaddr)
==>|-read persistent_address
==>|-read local_ipaddr
|-spin_unlock_bh
when iscsi_conn_teardown and iscsi_conn_get_param happen in parallel,
may trigger UAF issues.
Signed-off-by: Lixiaokeng<lixiaokeng@huawei.com>
Signed-off-by: Linfeilong<linfeilong@huawei.com>
Reported-by: Lu Tixiong<lutianxiong@huawei.com>
---
drivers/scsi/libiscsi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 284b939fb1ea..059dae8909ee 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -3100,6 +3100,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
{
struct iscsi_conn *conn = cls_conn->dd_data;
struct iscsi_session *session = conn->session;
+ char *tmp_persistent_address = conn->persistent_address;
+ char *tmp_local_ipaddr = conn->local_ipaddr;
del_timer_sync(&conn->transport_timer);
@@ -3121,8 +3123,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
spin_lock_bh(&session->frwd_lock);
free_pages((unsigned long) conn->data,
get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
- kfree(conn->persistent_address);
- kfree(conn->local_ipaddr);
/* regular RX path uses back_lock */
spin_lock_bh(&session->back_lock);
kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
@@ -3134,6 +3134,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
mutex_unlock(&session->eh_mutex);
iscsi_destroy_conn(cls_conn);
+ kfree(tmp_persistent_address);
+ kfree(tmp_local_ipaddr);
}
EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
--
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent
2021-12-20 11:39 [PATCH] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent lixiaokeng
@ 2021-12-20 19:54 ` michael.christie
2021-12-20 21:25 ` Lee Duncan
2021-12-23 5:08 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: michael.christie @ 2021-12-20 19:54 UTC (permalink / raw)
To: lixiaokeng, lduncan, cleech, linux-scsi; +Cc: linfeilong
On 12/20/21 5:39 AM, lixiaokeng wrote:
> |- iscsi_if_destroy_conn |-dev_attr_show
> |-iscsi_conn_teardown
> |-spin_lock_bh |-iscsi_sw_tcp_conn_get_param
>
> |-kfree(conn->persistent_address) |-iscsi_conn_get_param
> |-kfree(conn->local_ipaddr)
> ==>|-read persistent_address
> ==>|-read local_ipaddr
> |-spin_unlock_bh
>
> when iscsi_conn_teardown and iscsi_conn_get_param happen in parallel,
> may trigger UAF issues.
>
> Signed-off-by: Lixiaokeng<lixiaokeng@huawei.com>
> Signed-off-by: Linfeilong<linfeilong@huawei.com>
> Reported-by: Lu Tixiong<lutianxiong@huawei.com>
> ---
> drivers/scsi/libiscsi.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
> index 284b939fb1ea..059dae8909ee 100644
> --- a/drivers/scsi/libiscsi.c
> +++ b/drivers/scsi/libiscsi.c
> @@ -3100,6 +3100,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
> {
> struct iscsi_conn *conn = cls_conn->dd_data;
> struct iscsi_session *session = conn->session;
> + char *tmp_persistent_address = conn->persistent_address;
> + char *tmp_local_ipaddr = conn->local_ipaddr;
>
> del_timer_sync(&conn->transport_timer);
>
> @@ -3121,8 +3123,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
> spin_lock_bh(&session->frwd_lock);
> free_pages((unsigned long) conn->data,
> get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
> - kfree(conn->persistent_address);
> - kfree(conn->local_ipaddr);
> /* regular RX path uses back_lock */
> spin_lock_bh(&session->back_lock);
> kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
> @@ -3134,6 +3134,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
> mutex_unlock(&session->eh_mutex);
>
> iscsi_destroy_conn(cls_conn);
> + kfree(tmp_persistent_address);
> + kfree(tmp_local_ipaddr);
> }
> EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent
2021-12-20 11:39 [PATCH] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent lixiaokeng
2021-12-20 19:54 ` michael.christie
@ 2021-12-20 21:25 ` Lee Duncan
2021-12-23 5:08 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Lee Duncan @ 2021-12-20 21:25 UTC (permalink / raw)
To: lixiaokeng, cleech, linux-scsi; +Cc: linfeilong
On 12/20/21 3:39 AM, lixiaokeng wrote:
> |- iscsi_if_destroy_conn |-dev_attr_show
> |-iscsi_conn_teardown
> |-spin_lock_bh |-iscsi_sw_tcp_conn_get_param
>
> |-kfree(conn->persistent_address) |-iscsi_conn_get_param
> |-kfree(conn->local_ipaddr)
> ==>|-read persistent_address
> ==>|-read local_ipaddr
> |-spin_unlock_bh
>
> when iscsi_conn_teardown and iscsi_conn_get_param happen in parallel,
> may trigger UAF issues.
>
> Signed-off-by: Lixiaokeng<lixiaokeng@huawei.com>
> Signed-off-by: Linfeilong<linfeilong@huawei.com>
> Reported-by: Lu Tixiong<lutianxiong@huawei.com>
> ---
> drivers/scsi/libiscsi.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
> index 284b939fb1ea..059dae8909ee 100644
> --- a/drivers/scsi/libiscsi.c
> +++ b/drivers/scsi/libiscsi.c
> @@ -3100,6 +3100,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
> {
> struct iscsi_conn *conn = cls_conn->dd_data;
> struct iscsi_session *session = conn->session;
> + char *tmp_persistent_address = conn->persistent_address;
> + char *tmp_local_ipaddr = conn->local_ipaddr;
>
> del_timer_sync(&conn->transport_timer);
>
> @@ -3121,8 +3123,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
> spin_lock_bh(&session->frwd_lock);
> free_pages((unsigned long) conn->data,
> get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
> - kfree(conn->persistent_address);
> - kfree(conn->local_ipaddr);
> /* regular RX path uses back_lock */
> spin_lock_bh(&session->back_lock);
> kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
> @@ -3134,6 +3134,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
> mutex_unlock(&session->eh_mutex);
>
> iscsi_destroy_conn(cls_conn);
> + kfree(tmp_persistent_address);
> + kfree(tmp_local_ipaddr);
> }
> EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
>
Reviewed-by: Lee Duncan <lduncan@suse.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent
2021-12-20 11:39 [PATCH] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent lixiaokeng
2021-12-20 19:54 ` michael.christie
2021-12-20 21:25 ` Lee Duncan
@ 2021-12-23 5:08 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2021-12-23 5:08 UTC (permalink / raw)
To: lduncan, cleech, linux-scsi, lixiaokeng; +Cc: Martin K . Petersen, linfeilong
On Mon, 20 Dec 2021 19:39:06 +0800, lixiaokeng wrote:
> |- iscsi_if_destroy_conn |-dev_attr_show
> |-iscsi_conn_teardown
> |-spin_lock_bh |-iscsi_sw_tcp_conn_get_param
>
> |-kfree(conn->persistent_address) |-iscsi_conn_get_param
> |-kfree(conn->local_ipaddr)
> ==>|-read persistent_address
> ==>|-read local_ipaddr
> |-spin_unlock_bh
>
> [...]
Applied to 5.16/scsi-fixes, thanks!
[1/1] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent
https://git.kernel.org/mkp/scsi/c/1b8d0300a3e9
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-12-23 5:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-20 11:39 [PATCH] libiscsi: fix UAF when iscsi_conn_get_param and iscsi_conn_teardown concurrent lixiaokeng
2021-12-20 19:54 ` michael.christie
2021-12-20 21:25 ` Lee Duncan
2021-12-23 5:08 ` Martin K. Petersen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.