scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
authorLixiaokeng <lixiaokeng@huawei.com>
Mon, 20 Dec 2021 11:39:06 +0000 (19:39 +0800)
committerMartin K. Petersen <martin.petersen@oracle.com>
Thu, 23 Dec 2021 04:03:59 +0000 (23:03 -0500)
commit1b8d0300a3e9f216ae4901bab886db7299899ec6
tree8ee913851e6319b98594665013eb08e9745d03d1
parent9020be114a47bf7ff33e179b3bb0016b91a098e6
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()

|- iscsi_if_destroy_conn            |-dev_attr_show
 |-iscsi_conn_teardown
  |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param

  |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
  |-kfree(conn->local_ipaddr)
                                       ==>|-read persistent_address
                                       ==>|-read local_ipaddr
  |-spin_unlock_bh

When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
UAF may be triggered.

Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com
Reported-by: Lu Tixiong <lutianxiong@huawei.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Lixiaokeng <lixiaokeng@huawei.com>
Signed-off-by: Linfeilong <linfeilong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/libiscsi.c