Skip to content
Commit 1b8d0300 authored by Lixiaokeng's avatar Lixiaokeng Committed by Martin K. Petersen
Browse files

scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()

|- iscsi_if_destroy_conn            |-dev_attr_show
 |-iscsi_conn_teardown
  |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param

  |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
  |-kfree(conn->local_ipaddr)
                                       ==>|-read persistent_address
                                       ==>|-read local_ipaddr
  |-spin_unlock_bh

When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
UAF may be triggered.

Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com


Reported-by: default avatarLu Tixiong <lutianxiong@huawei.com>
Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Reviewed-by: default avatarLee Duncan <lduncan@suse.com>
Signed-off-by: default avatarLixiaokeng <lixiaokeng@huawei.com>
Signed-off-by: default avatarLinfeilong <linfeilong@huawei.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 9020be11
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment