From patchwork Wed Jul 12 23:06:07 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Khazhy Kumykov X-Patchwork-Id: 9837553 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5E6CC60393 for ; Wed, 12 Jul 2017 23:08:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4FA4128569 for ; Wed, 12 Jul 2017 23:08:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 43E6C28636; Wed, 12 Jul 2017 23:08:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, MIME_HEADER_CTYPE_ONLY, MIME_NO_TEXT, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_TVD_MIME_NO_HEADERS autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CE84F28569 for ; Wed, 12 Jul 2017 23:07:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750923AbdGLXHs (ORCPT ); Wed, 12 Jul 2017 19:07:48 -0400 Received: from mail-pg0-f49.google.com ([74.125.83.49]:35533 "EHLO mail-pg0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750766AbdGLXHr (ORCPT ); Wed, 12 Jul 2017 19:07:47 -0400 Received: by mail-pg0-f49.google.com with SMTP id j186so19908726pge.2 for ; Wed, 12 Jul 2017 16:07:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=jgKL5hbkf/mHq3JakHHMBMkz/mmqof5VlZ/kYJLSFeg=; b=MoBtU4uDUg1Hi+LQt8QMouvRdJOegwrpYfrzPDbmuvRc8NFnEad8rnYlBhhU2MR5hI 8o3XUUDJmPRuBLP11T+dcccu8GQrI2SEQBpIFOG9HF2L+J0oGN9A0FW8r+mDnj/1D/h7 3kmbyT/Ro70H11zg5SmezfHlLC3rdOSR7ugLcbbPZVJYh7C44W9bRV65C3Dokcge1mCd T+QigB+xlFIoi42D1AhkrcyxdiISu+3EJgy1iyeUTk/gixYIKoC1VMR1teRxQnJ1Kkgo ZLfq+18q9wIG2W/g0ulrvs9T/NGwF/y1hMxUndqyWtbWiNEzbXLs2SJXreSIQpQZZHcG ffoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=jgKL5hbkf/mHq3JakHHMBMkz/mmqof5VlZ/kYJLSFeg=; b=CuKtZMCLNY3Rbt22TlpZFMztkTEVSyV0xIR0f4kyfJ2FypV+AJhIbq6qpZHZmEvYjc fe0RTLyAywAHo3+RQ7YTcAaVr/y+COaS7fi90yhSMeuz+xHoQeRorWz+H7npTRiAMwSU QmkP+ah8pm+LkcBzs45cWyEHIEFDKfo1S07Gzc2af9cGunuMV5rc+dBIQw2KxKghfkxK J9itpH0qDvDFjDAGQNrtbITrpgxg0Ju3DUIMmPPXlQRssDIuw0/rO4oTyP+2OgIbpEF4 JuiXY1LjxGgX709CE32n9/4Ia1meTzjntObaINNnolc2+e772JyGYmpu+Yxwd9dlFRN1 pWVg== X-Gm-Message-State: AIVw112yU6lNZQIGZ231Vq26HCPMPsAgQk8aCean67MjYqFWKzRf1Lah L7QijLImb8JahQ8/8ix7mA== X-Received: by 10.99.3.15 with SMTP id 15mr5993552pgd.99.1499900866172; Wed, 12 Jul 2017 16:07:46 -0700 (PDT) Received: from khazhy.svl.corp.google.com ([100.123.228.94]) by smtp.gmail.com with ESMTPSA id x14sm7364373pfe.83.2017.07.12.16.07.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 12 Jul 2017 16:07:45 -0700 (PDT) From: Khazhismel Kumykov To: lduncan@suse.com, cleech@redhat.com Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, open-iscsi@googlegroups.com, Khazhismel Kumykov Subject: [PATCH] libiscsi: Fix use-after-free race during iscsi_session_teardown Date: Wed, 12 Jul 2017 16:06:07 -0700 Message-Id: <20170712230607.137389-1-khazhy@google.com> X-Mailer: git-send-email 2.13.2.932.g7449e964c-goog Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Session attributes exposed through sysfs were freed before the device was destroyed, resulting in a potential use-after-free. Free these attributes after removing the device. Signed-off-by: Khazhismel Kumykov --- drivers/scsi/libiscsi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 42381adf0769..f9199bebaec7 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup); /** * iscsi_session_teardown - destroy session, host, and cls_session * @cls_session: iscsi session - * - * The driver must have called iscsi_remove_session before - * calling this. */ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) { @@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) iscsi_pool_free(&session->cmdpool); + iscsi_remove_session(session); + kfree(session->password); kfree(session->password_in); kfree(session->username); @@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) kfree(session->portal_type); kfree(session->discovery_parent_type); - iscsi_destroy_session(cls_session); + iscsi_free_session(cls_session); + iscsi_host_dec_session_cnt(shost); module_put(owner); }