Lixiaokeng 7aa2e7abdc scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
[ Upstream commit 1b8d0300a3e9f216ae4901bab886db7299899ec6 ]

|- iscsi_if_destroy_conn            |-dev_attr_show
 |-iscsi_conn_teardown
  |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param

  |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
  |-kfree(conn->local_ipaddr)
                                       ==>|-read persistent_address
                                       ==>|-read local_ipaddr
  |-spin_unlock_bh

When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
UAF may be triggered.

Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com
Reported-by: Lu Tixiong <lutianxiong@huawei.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Lixiaokeng <lixiaokeng@huawei.com>
Signed-off-by: Linfeilong <linfeilong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-11 13:38:12 +01:00
..
2020-12-29 13:44:50 +01:00
2021-05-22 10:40:18 +02:00
2016-07-20 17:38:35 -06:00
2015-04-27 10:10:19 -07:00
2015-04-27 10:04:39 -07:00
2015-04-27 10:05:55 -07:00
2015-04-17 10:13:56 -07:00
2015-11-25 22:08:55 -05:00
2021-11-26 11:48:36 +01:00
2016-02-23 21:27:02 -05:00
2016-05-10 22:01:07 -04:00
2017-12-20 10:07:22 +01:00
2016-02-25 21:10:53 -05:00
2019-11-28 18:28:23 +01:00
2016-01-27 20:36:10 +08:00
2021-05-22 10:40:25 +02:00
2016-01-27 20:36:10 +08:00
2016-09-26 20:49:25 -04:00
2016-02-23 21:27:02 -05:00
2016-11-28 15:51:31 -05:00
2016-10-07 09:28:53 -07:00
2016-02-23 21:27:02 -05:00
2021-05-22 10:40:26 +02:00
2015-11-18 11:59:09 -05:00
2016-02-23 21:27:02 -05:00
2021-05-22 10:40:26 +02:00