scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
stable inclusion from stable-v5.10.91 commit 8c87a83ef891aff7f8d620abac841dadbf780035 bugzilla: 186187 https://gitee.com/openeuler/kernel/issues/I4SI2C Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8c87a83ef891aff7f8d620abac841dadbf780035 -------------------------------- [ Upstream commit 1b8d0300 ] |- iscsi_if_destroy_conn |-dev_attr_show |-iscsi_conn_teardown |-spin_lock_bh |-iscsi_sw_tcp_conn_get_param |-kfree(conn->persistent_address) |-iscsi_conn_get_param |-kfree(conn->local_ipaddr) ==>|-read persistent_address ==>|-read local_ipaddr |-spin_unlock_bh When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a UAF may be triggered. Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com Reported-by:Lu Tixiong <lutianxiong@huawei.com> Reviewed-by:
Mike Christie <michael.christie@oracle.com> Reviewed-by:
Lee Duncan <lduncan@suse.com> Signed-off-by:
Lixiaokeng <lixiaokeng@huawei.com> Signed-off-by:
Linfeilong <linfeilong@huawei.com> Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
Chen Jun <chenjun102@huawei.com> Signed-off-by:
Zheng Zengkai <zhengzengkai@huawei.com>
Loading
Please sign in to comment