| Message ID | 20220309030916.2932316-4-haowenchao@huawei.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | scsi:iscsi: handle iscsi_cls_conn device with sysfs | expand |
On 3/8/22 9:09 PM, Wenchao Hao wrote: > diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c > index ca724eed4f4d..7b4d998708e7 100644 > --- a/drivers/scsi/scsi_transport_iscsi.c > +++ b/drivers/scsi/scsi_transport_iscsi.c > @@ -2165,6 +2165,7 @@ static int iscsi_iter_destroy_conn_fn(struct device *dev, void *data) > { > if (!iscsi_is_conn_dev(dev)) > return 0; > + iscsi_remove_conn(iscsi_dev_to_conn(dev)); > return iscsi_destroy_conn(iscsi_dev_to_conn(dev)); Just do: iscsi_remove_conn iscsi_put_conn return 0; > } > > @@ -2463,7 +2464,7 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) > > transport_unregister_device(&conn->dev); > ISCSI_DBG_TRANS_CONN(conn, "Completing conn destruction\n"); > - device_unregister(&conn->dev); > + iscsi_free_conn(conn); > return 0; > } > EXPORT_SYMBOL_GPL(iscsi_destroy_conn);
On 3/8/22 9:09 PM, Wenchao Hao wrote: > @@ -3143,8 +3145,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) > mutex_unlock(&session->eh_mutex); > > iscsi_destroy_conn(cls_conn); This should then be a iscsi_put_conn. So basically it balances out. iscsi_alloc_conn requires iscsi_put_conn. The put releases what is done in the alloc. The put on the parent is done in the release though. iscsi_add_conn requires iscsi_remove_conn. The remove undoes what was done in the add We don't want a iscsi_destroy_conn which does a iscsi_free_conn because it makes it confusing.
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 43f903bce0b8..0d57521751dd 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -3109,8 +3109,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) { struct iscsi_conn *conn = cls_conn->dd_data; struct iscsi_session *session = conn->session; - char *tmp_persistent_address = conn->persistent_address; - char *tmp_local_ipaddr = conn->local_ipaddr; + + iscsi_remove_conn(cls_conn); del_timer_sync(&conn->transport_timer); @@ -3132,6 +3132,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) spin_lock_bh(&session->frwd_lock); free_pages((unsigned long) conn->data, get_order(ISCSI_DEF_MAX_RECV_SEG_LEN)); + kfree(conn->persistent_address); + kfree(conn->local_ipaddr); /* regular RX path uses back_lock */ spin_lock_bh(&session->back_lock); kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task, @@ -3143,8 +3145,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) mutex_unlock(&session->eh_mutex); iscsi_destroy_conn(cls_conn); - kfree(tmp_persistent_address); - kfree(tmp_local_ipaddr); } EXPORT_SYMBOL_GPL(iscsi_conn_teardown); diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c index ca724eed4f4d..7b4d998708e7 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2165,6 +2165,7 @@ static int iscsi_iter_destroy_conn_fn(struct device *dev, void *data) { if (!iscsi_is_conn_dev(dev)) return 0; + iscsi_remove_conn(iscsi_dev_to_conn(dev)); return iscsi_destroy_conn(iscsi_dev_to_conn(dev)); } @@ -2463,7 +2464,7 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) transport_unregister_device(&conn->dev); ISCSI_DBG_TRANS_CONN(conn, "Completing conn destruction\n"); - device_unregister(&conn->dev); + iscsi_free_conn(conn); return 0; } EXPORT_SYMBOL_GPL(iscsi_destroy_conn);
commit 1b8d0300a3e9 ("scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()") fixed an UAF in iscsi_conn_get_param() and introduced 2 tmp_xxx varibles, the implement looks ugly. We can fix this UAF with the help of device_del() gracefully. Call iscsi_remove_conn() at the beginning of iscsi_conn_teardown would make userspace unable to see iscsi_cls_conn any more, then we can free memory safely. Signed-off-by: Wenchao Hao <haowenchao@huawei.com> Signed-off-by: Wu Bo <wubo40@huawei.com> --- drivers/scsi/libiscsi.c | 8 ++++---- drivers/scsi/scsi_transport_iscsi.c | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-)