]> git.baikalelectronics.ru Git - kernel.git/commit
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
authorLixiaokeng <lixiaokeng@huawei.com>
Mon, 20 Dec 2021 11:39:06 +0000 (19:39 +0800)
committerMartin K. Petersen <martin.petersen@oracle.com>
Thu, 23 Dec 2021 04:03:59 +0000 (23:03 -0500)
commit0e49b49181bc797ac66cf59b2e7563075a682f4d
tree8ee913851e6319b98594665013eb08e9745d03d1
parent090fe724b89f2a5833812cc1ad2f865832d49afe
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()

|- iscsi_if_destroy_conn            |-dev_attr_show
 |-iscsi_conn_teardown
  |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param

  |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
  |-kfree(conn->local_ipaddr)
                                       ==>|-read persistent_address
                                       ==>|-read local_ipaddr
  |-spin_unlock_bh

When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
UAF may be triggered.

Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com
Reported-by: Lu Tixiong <lutianxiong@huawei.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Lixiaokeng <lixiaokeng@huawei.com>
Signed-off-by: Linfeilong <linfeilong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/libiscsi.c