Unverified Commit b63c2f8c authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8069 CVE-2021-47427 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Nan <linan122@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5HL4F5QOLSWUSZZRAOQHG66VVUNN6JFZ/ 
Mike Christie (2):
  scsi: iscsi: Have abort handler get ref to conn
  scsi: iscsi: Fix iscsi_task use after free


-- 
2.39.2
 
https://gitee.com/src-openeuler/kernel/issues/I9R4O4 
 
Link:https://gitee.com/openeuler/kernel/pulls/8069

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Reviewed-by: default avatarYu Kuai <yukuai3@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 81c17fd3 9931deb6

drivers/scsi/libiscsi.c

+8 −4
Original line number Diff line number Diff line
@@ -2285,10 +2285,6 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) 
		return FAILED;

	}



	conn = session->leadconn;

	conn->eh_abort_cnt++;

	age = session->age;



	spin_lock(&session->back_lock);

	task = (struct iscsi_task *)sc->SCp.ptr;

	if (!task || !task->sc) {
@@ -2300,6 +2296,12 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) 
		mutex_unlock(&session->eh_mutex);

		return SUCCESS;

	}



	conn = session->leadconn;

	iscsi_get_conn(conn->cls_conn);

	conn->eh_abort_cnt++;

	age = session->age;



	ISCSI_DBG_EH(session, "aborting [sc %p itt 0x%x]\n", sc, task->itt);

	__iscsi_get_task(task);

	spin_unlock(&session->back_lock);
@@ -2365,6 +2367,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) 
	ISCSI_DBG_EH(session, "abort success [sc %p itt 0x%x]\n",

		     sc, task->itt);

	iscsi_put_task(task);

	iscsi_put_conn(conn->cls_conn);

	mutex_unlock(&session->eh_mutex);

	return SUCCESS;
@@ -2374,6 +2377,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) 
	ISCSI_DBG_EH(session, "abort failed [sc %p itt 0x%x]\n", sc,

		     task ? task->itt : 0);

	iscsi_put_task(task);

	iscsi_put_conn(conn->cls_conn);

	mutex_unlock(&session->eh_mutex);

	return FAILED;

}