| Message ID | 20191111182944.191123-3-bvanassche@acm.org (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | Improve SPC-2 reservation support | expand |
On Mon, Nov 11, 2019 at 10:29:44AM -0800, Bart Van Assche wrote: > This patch fixes the following use-after-free in the code that supports > SPC-2 reservations: > > BUG: KASAN: use-after-free in target_check_reservation+0x171/0x980 [target_core_mod] > Read of size 8 at addr ffff88802ecd1878 by task iscsi_trx/17200 > > CPU: 0 PID: 17200 Comm: iscsi_trx Not tainted 5.4.0-rc1-dbg+ #1 > Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 > Call Trace: > dump_stack+0x8a/0xd6 > print_address_description.constprop.0+0x40/0x60 > __kasan_report.cold+0x1b/0x34 > kasan_report+0x16/0x20 > __asan_load8+0x58/0x90 > target_check_reservation+0x171/0x980 [target_core_mod] > __target_execute_cmd+0xb1/0xf0 [target_core_mod] > target_execute_cmd+0x22d/0x4d0 [target_core_mod] > transport_generic_new_cmd+0x31f/0x5b0 [target_core_mod] > transport_handle_cdb_direct+0x6f/0x90 [target_core_mod] > iscsit_execute_cmd+0x381/0x3f0 [iscsi_target_mod] > iscsit_sequence_cmd+0x13b/0x1f0 [iscsi_target_mod] > iscsit_process_scsi_cmd+0x4c/0x130 [iscsi_target_mod] > iscsit_get_rx_pdu+0x8e8/0x15f0 [iscsi_target_mod] > iscsi_target_rx_thread+0x105/0x1b0 [iscsi_target_mod] > kthread+0x1bc/0x210 > ret_from_fork+0x24/0x30 > > Allocated by task 1079: > save_stack+0x23/0x90 > __kasan_kmalloc.constprop.0+0xcf/0xe0 > kasan_slab_alloc+0x12/0x20 > kmem_cache_alloc+0xfe/0x3a0 > transport_alloc_session+0x29/0x80 [target_core_mod] > iscsi_target_login_thread+0xceb/0x1920 [iscsi_target_mod] > kthread+0x1bc/0x210 > ret_from_fork+0x24/0x30 > > Freed by task 17193: > save_stack+0x23/0x90 > __kasan_slab_free+0x13a/0x190 > kasan_slab_free+0x12/0x20 > kmem_cache_free+0xc8/0x3e0 > transport_free_session+0x179/0x2f0 [target_core_mod] > transport_deregister_session+0x121/0x170 [target_core_mod] > iscsit_close_session+0x12c/0x350 [iscsi_target_mod] > iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod] > iscsit_response_queue+0x8fa/0xc00 [iscsi_target_mod] > iscsi_target_tx_thread+0x28e/0x390 [iscsi_target_mod] > kthread+0x1bc/0x210 > ret_from_fork+0x24/0x30 > > The buggy address belongs to the object at ffff88802ecd1860 > which belongs to the cache se_sess_cache of size 352 > The buggy address is located 24 bytes inside of > 352-byte region [ffff88802ecd1860, ffff88802ecd19c0) > The buggy address belongs to the page: > page:ffffea0000bb3400 refcount:1 mapcount:0 mapping:ffff8880bef2ed00 index:0x0 compound_mapcount: 0 > flags: 0x1000000000010200(slab|head) > raw: 1000000000010200 dead000000000100 dead000000000122 ffff8880bef2ed00 > raw: 0000000000000000 0000000080270027 00000001ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff88802ecd1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff88802ecd1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > >ffff88802ecd1800: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb > ^ > ffff88802ecd1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff88802ecd1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > Cc: Mike Christie <mchristi@redhat.com> > Signed-off-by: Bart Van Assche <bvanassche@acm.org> > --- > drivers/target/target_core_transport.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c > index ba7a01bcad7c..12bc8545f91b 100644 > --- a/drivers/target/target_core_transport.c > +++ b/drivers/target/target_core_transport.c > @@ -584,6 +584,15 @@ void transport_free_session(struct se_session *se_sess) > } > EXPORT_SYMBOL(transport_free_session); > > +static int target_release_res(struct se_device *dev, void *data) > +{ > + struct se_session *sess = data; > + > + if (dev->reservation_holder == sess) > + dev->reservation_holder = NULL; Hi Bart, Does it worth to use target_release_reservation() when the session is reserveration holder instead of the explicit assignment? That would also reset reservation flags of the se_device. > + return 0; > +} > + > void transport_deregister_session(struct se_session *se_sess) > { > struct se_portal_group *se_tpg = se_sess->se_tpg; > @@ -600,6 +609,8 @@ void transport_deregister_session(struct se_session *se_sess) > se_sess->fabric_sess_ptr = NULL; > spin_unlock_irqrestore(&se_tpg->session_lock, flags); > > + target_for_each_device(target_release_res, se_sess); > + > pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n", > se_tpg->se_tpg_tfo->fabric_name); > /* > -- > 2.24.0.rc1.363.gb1bccd3e3d-goog > IMO the code is not specific to iscsi and the tag should be changed to "target/core:" Thanks, Roman
On 11/11/19 11:41 AM, Roman Bolshakov wrote: > On Mon, Nov 11, 2019 at 10:29:44AM -0800, Bart Van Assche wrote: >> +static int target_release_res(struct se_device *dev, void *data) >> +{ >> + struct se_session *sess = data; >> + >> + if (dev->reservation_holder == sess) >> + dev->reservation_holder = NULL; > > Does it worth to use target_release_reservation() when the session is > reserveration holder instead of the explicit assignment? That would also > reset reservation flags of the se_device. That sounds like a good idea to me. I will look into this. > IMO the code is not specific to iscsi and the tag should be changed to > "target/core:" Agreed. I will fix the patch subject. Bart.
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index ba7a01bcad7c..12bc8545f91b 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -584,6 +584,15 @@ void transport_free_session(struct se_session *se_sess) } EXPORT_SYMBOL(transport_free_session); +static int target_release_res(struct se_device *dev, void *data) +{ + struct se_session *sess = data; + + if (dev->reservation_holder == sess) + dev->reservation_holder = NULL; + return 0; +} + void transport_deregister_session(struct se_session *se_sess) { struct se_portal_group *se_tpg = se_sess->se_tpg; @@ -600,6 +609,8 @@ void transport_deregister_session(struct se_session *se_sess) se_sess->fabric_sess_ptr = NULL; spin_unlock_irqrestore(&se_tpg->session_lock, flags); + target_for_each_device(target_release_res, se_sess); + pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n", se_tpg->se_tpg_tfo->fabric_name); /*