Commit f6c4d9d5 authored by Lixiaokeng's avatar Lixiaokeng Committed by Zheng Zengkai
Browse files

scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()

stable inclusion
from stable-v5.10.91
commit 8c87a83ef891aff7f8d620abac841dadbf780035
bugzilla: 186187 https://gitee.com/openeuler/kernel/issues/I4SI2C

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8c87a83ef891aff7f8d620abac841dadbf780035

--------------------------------

[ Upstream commit 1b8d0300 ]

|- iscsi_if_destroy_conn            |-dev_attr_show
 |-iscsi_conn_teardown
  |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param

  |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
  |-kfree(conn->local_ipaddr)
                                       ==>|-read persistent_address
                                       ==>|-read local_ipaddr
  |-spin_unlock_bh

When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
UAF may be triggered.

Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com


Reported-by: default avatarLu Tixiong <lutianxiong@huawei.com>
Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Reviewed-by: default avatarLee Duncan <lduncan@suse.com>
Signed-off-by: default avatarLixiaokeng <lixiaokeng@huawei.com>
Signed-off-by: default avatarLinfeilong <linfeilong@huawei.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent b7527e87
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment