Commit 3c28d59b authored by Mike Christie's avatar Mike Christie Committed by Li Nan
Browse files

scsi: iscsi: Have abort handler get ref to conn 

mainline inclusion
from mainline-v5.14-rc1
commit d39df158
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O4
CVE: CVE-2021-47427

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d39df158518ccc3bf24ee18082b5e100c8f014aa

--------------------------------

If SCSI midlayer is aborting a task when we are tearing down the conn we
could free the conn while the abort thread is accessing the conn. This has
the abort handler get a ref to the conn so it won't be freed from under it.

Note: this is not needed for device/target reset because we are holding the
eh_mutex when accessing the conn.

Link: https://lore.kernel.org/r/20210525181821.7617-12-michael.christie@oracle.com


Reviewed-by: default avatarLee Duncan <lduncan@suse.com>
Signed-off-by: default avatarMike Christie <michael.christie@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parent f300accf

drivers/scsi/libiscsi.c

+4 −3
Original line number Diff line number Diff line
@@ -2286,6 +2286,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) 
	}



	conn = session->leadconn;

	iscsi_get_conn(conn->cls_conn);

	conn->eh_abort_cnt++;

	age = session->age;
@@ -2296,9 +2297,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) 
		ISCSI_DBG_EH(session, "sc completed while abort in progress\n");



		spin_unlock(&session->back_lock);

		spin_unlock_bh(&session->frwd_lock);

		mutex_unlock(&session->eh_mutex);

		return SUCCESS;

		goto success;

	}

	ISCSI_DBG_EH(session, "aborting [sc %p itt 0x%x]\n", sc, task->itt);

	__iscsi_get_task(task);
@@ -2365,6 +2364,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) 
	ISCSI_DBG_EH(session, "abort success [sc %p itt 0x%x]\n",

		     sc, task->itt);

	iscsi_put_task(task);

	iscsi_put_conn(conn->cls_conn);

	mutex_unlock(&session->eh_mutex);

	return SUCCESS;
@@ -2374,6 +2374,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) 
	ISCSI_DBG_EH(session, "abort failed [sc %p itt 0x%x]\n", sc,

		     task ? task->itt : 0);

	iscsi_put_task(task);

	iscsi_put_conn(conn->cls_conn);

	mutex_unlock(&session->eh_mutex);

	return FAILED;

}