From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Mike Christie <michael.christie@oracle.com>,
Lee Duncan <lduncan@suse.com>, Ding Hui <dinghui@sangfor.com.cn>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>,
cleech@redhat.com, jejb@linux.ibm.com,
open-iscsi@googlegroups.com, linux-scsi@vger.kernel.org
Subject: [PATCH AUTOSEL 5.15 06/12] scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
Date: Tue, 31 Jan 2023 10:00:24 -0500 [thread overview]
Message-ID: <20230131150030.1250104-6-sashal@kernel.org> (raw)
In-Reply-To: <20230131150030.1250104-1-sashal@kernel.org>
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3 ]
If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,
userspace could be accessing the host's ipaddress attr. If we then free the
session via iscsi_session_teardown() while userspace is still accessing the
session we will hit a use after free bug.
Set the tcp_sw_host->session after we have completed session creation and
can no longer fail.
Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Acked-by: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/iscsi_tcp.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 5c19e75c0e2f..594336004190 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -848,7 +848,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
enum iscsi_host_param param, char *buf)
{
struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(shost);
- struct iscsi_session *session = tcp_sw_host->session;
+ struct iscsi_session *session;
struct iscsi_conn *conn;
struct iscsi_tcp_conn *tcp_conn;
struct iscsi_sw_tcp_conn *tcp_sw_conn;
@@ -858,6 +858,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
switch (param) {
case ISCSI_HOST_PARAM_IPADDRESS:
+ session = tcp_sw_host->session;
if (!session)
return -ENOTCONN;
@@ -958,11 +959,13 @@ iscsi_sw_tcp_session_create(struct iscsi_endpoint *ep, uint16_t cmds_max,
if (!cls_session)
goto remove_host;
session = cls_session->dd_data;
- tcp_sw_host = iscsi_host_priv(shost);
- tcp_sw_host->session = session;
if (iscsi_tcp_r2tpool_alloc(session))
goto remove_session;
+
+ /* We are now fully setup so expose the session to sysfs. */
+ tcp_sw_host = iscsi_host_priv(shost);
+ tcp_sw_host->session = session;
return cls_session;
remove_session:
--
2.39.0
next prev parent reply other threads:[~2023-01-31 15:03 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-31 15:00 [PATCH AUTOSEL 5.15 01/12] i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 02/12] i2c: mxs: suppress probe-deferral error message Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 03/12] scsi: target: core: Fix warning on RT kernels Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 04/12] perf/x86/intel: Add Emerald Rapids Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 05/12] scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Sasha Levin
2023-01-31 15:00 ` Sasha Levin [this message]
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 07/12] i2c: rk3x: fix a bunch of kernel-doc warnings Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 08/12] platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 09/12] platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 10/12] net/x25: Fix to not accept on connected socket Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 11/12] drm/amd/display: Fix timing not changning when freesync video is enabled Sasha Levin
2023-01-31 15:00 ` [PATCH AUTOSEL 5.15 12/12] amdgpu: fix build on non-DCN platforms Sasha Levin
2023-01-31 20:29 ` Alex Deucher
2023-02-05 14:17 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230131150030.1250104-6-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=cleech@redhat.com \
--cc=dinghui@sangfor.com.cn \
--cc=jejb@linux.ibm.com \
--cc=lduncan@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=michael.christie@oracle.com \
--cc=open-iscsi@googlegroups.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).