From: Wenchao Hao <haowenchao@huawei.com>
To: Mike Christie <michael.christie@oracle.com>,
Lee Duncan <lduncan@suse.com>, Chris Leech <cleech@redhat.com>,
"James E . J . Bottomley" <jejb@linux.ibm.com>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
<open-iscsi@googlegroups.com>, <linux-scsi@vger.kernel.org>,
<linux-kernel@vger.kernel.org>
Cc: Wu Bo <wubo40@huawei.com>,
Zhiqiang Liu <liuzhiqiang26@huawei.com>, <linfeilong@huawei.com>,
Wenchao Hao <haowenchao@huawei.com>
Subject: [PATCH v3 3/3] scsi:libiscsi: teradown iscsi_cls_conn gracefully
Date: Wed, 9 Mar 2022 20:57:59 -0500 [thread overview]
Message-ID: <20220310015759.3296841-4-haowenchao@huawei.com> (raw)
In-Reply-To: <20220310015759.3296841-1-haowenchao@huawei.com>
commit 1b8d0300a3e9 ("scsi: libiscsi: Fix UAF in
iscsi_conn_get_param()/iscsi_conn_teardown()") fixed an UAF in
iscsi_conn_get_param() and introduced 2 tmp_xxx varibles, the
implement looks ugly.
We can fix this UAF with the help of device_del() gracefully.
Call iscsi_remove_conn() at the beginning of iscsi_conn_teardown would
make userspace unable to see iscsi_cls_conn any more, then we can free
memory safely.
And remove iscsi_destroy_conn() by hand since it is not used now.
Signed-off-by: Wenchao Hao <haowenchao@huawei.com>
Signed-off-by: Wu Bo <wubo40@huawei.com>
---
drivers/scsi/libiscsi.c | 10 +++++-----
drivers/scsi/scsi_transport_iscsi.c | 27 +++++----------------------
include/scsi/scsi_transport_iscsi.h | 1 -
3 files changed, 10 insertions(+), 28 deletions(-)
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 38e68b449c08..da583a39b307 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -3109,8 +3109,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
{
struct iscsi_conn *conn = cls_conn->dd_data;
struct iscsi_session *session = conn->session;
- char *tmp_persistent_address = conn->persistent_address;
- char *tmp_local_ipaddr = conn->local_ipaddr;
+
+ iscsi_remove_conn(cls_conn);
del_timer_sync(&conn->transport_timer);
@@ -3132,6 +3132,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
spin_lock_bh(&session->frwd_lock);
free_pages((unsigned long) conn->data,
get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
+ kfree(conn->persistent_address);
+ kfree(conn->local_ipaddr);
/* regular RX path uses back_lock */
spin_lock_bh(&session->back_lock);
kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
@@ -3142,9 +3144,7 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
spin_unlock_bh(&session->frwd_lock);
mutex_unlock(&session->eh_mutex);
- iscsi_destroy_conn(cls_conn);
- kfree(tmp_persistent_address);
- kfree(tmp_local_ipaddr);
+ iscsi_put_conn(cls_conn);
}
EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index fc33000a6af9..d0f996d14782 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2165,7 +2165,11 @@ static int iscsi_iter_destroy_conn_fn(struct device *dev, void *data)
{
if (!iscsi_is_conn_dev(dev))
return 0;
- return iscsi_destroy_conn(iscsi_dev_to_conn(dev));
+
+ iscsi_remove_conn(iscsi_dev_to_conn(dev));
+ iscsi_put_conn(iscsi_dev_to_conn(dev));
+
+ return 0;
}
void iscsi_remove_session(struct iscsi_cls_session *session)
@@ -2437,27 +2441,6 @@ void iscsi_remove_conn(struct iscsi_cls_conn *conn)
}
EXPORT_SYMBOL_GPL(iscsi_remove_conn);
-/**
- * iscsi_destroy_conn - destroy iscsi class connection
- * @conn: iscsi cls session
- *
- * This can be called from a LLD or iscsi_transport.
- */
-int iscsi_destroy_conn(struct iscsi_cls_conn *conn)
-{
- unsigned long flags;
-
- spin_lock_irqsave(&connlock, flags);
- list_del(&conn->conn_list);
- spin_unlock_irqrestore(&connlock, flags);
-
- transport_unregister_device(&conn->dev);
- ISCSI_DBG_TRANS_CONN(conn, "Completing conn destruction\n");
- device_unregister(&conn->dev);
- return 0;
-}
-EXPORT_SYMBOL_GPL(iscsi_destroy_conn);
-
void iscsi_put_conn(struct iscsi_cls_conn *conn)
{
put_device(&conn->dev);
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 4af6768e8195..aedbc4488149 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -447,7 +447,6 @@ extern int iscsi_add_conn(struct iscsi_cls_conn *conn);
extern void iscsi_remove_conn(struct iscsi_cls_conn *conn);
extern void iscsi_put_conn(struct iscsi_cls_conn *conn);
extern void iscsi_get_conn(struct iscsi_cls_conn *conn);
-extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
extern void iscsi_unblock_session(struct iscsi_cls_session *session);
extern void iscsi_block_session(struct iscsi_cls_session *session);
extern int iscsi_scan_finished(struct Scsi_Host *shost, unsigned long time);
--
2.32.0
next prev parent reply other threads:[~2022-03-09 12:48 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-10 1:57 [PATCH v3 0/3] scsi:iscsi: handle iscsi_cls_conn device with sysfs correctly Wenchao Hao
2022-03-09 19:44 ` Mike Christie
2022-03-10 1:57 ` [PATCH v3 1/3] scsi: iscsi: Add helper functions to manage iscsi_cls_conn Wenchao Hao
2022-03-10 1:57 ` [PATCH v3 2/3] scsi:libiscsi: Add iscsi_cls_conn to sysfs after been initialized Wenchao Hao
2022-03-10 1:57 ` Wenchao Hao [this message]
2022-03-11 8:42 ` [PATCH v3 0/3] scsi:iscsi: handle iscsi_cls_conn device with sysfs correctly Wenchao Hao
2022-03-15 4:21 ` Martin K. Petersen
2022-03-19 3:56 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220310015759.3296841-4-haowenchao@huawei.com \
--to=haowenchao@huawei.com \
--cc=cleech@redhat.com \
--cc=jejb@linux.ibm.com \
--cc=lduncan@suse.com \
--cc=linfeilong@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=liuzhiqiang26@huawei.com \
--cc=martin.petersen@oracle.com \
--cc=michael.christie@oracle.com \
--cc=open-iscsi@googlegroups.com \
--cc=wubo40@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).