Lixiaokeng 847050d40d scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
[ Upstream commit 1b8d0300a3e9f216ae4901bab886db7299899ec6 ]

|- iscsi_if_destroy_conn            |-dev_attr_show
 |-iscsi_conn_teardown
  |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param

  |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
  |-kfree(conn->local_ipaddr)
                                       ==>|-read persistent_address
                                       ==>|-read local_ipaddr
  |-spin_unlock_bh

When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
UAF may be triggered.

Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com
Reported-by: Lu Tixiong <lutianxiong@huawei.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Lixiaokeng <lixiaokeng@huawei.com>
Signed-off-by: Linfeilong <linfeilong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-11 15:35:17 +01:00
..
2021-07-11 10:59:53 -07:00
2021-07-11 10:59:53 -07:00
2021-05-21 17:01:18 -04:00
2021-07-11 10:59:53 -07:00
2021-09-07 19:13:42 -07:00
2020-03-11 23:07:59 -04:00
2021-01-22 21:14:08 -05:00
2021-01-22 21:14:07 -05:00
2021-01-22 21:14:08 -05:00
2021-11-18 19:16:48 +01:00
2020-03-11 23:07:59 -04:00
2021-05-31 22:48:21 -04:00
2020-09-02 22:49:06 -04:00
2021-05-31 22:48:21 -04:00
2021-04-13 00:20:48 -04:00
2020-12-07 20:24:09 -05:00
2020-12-07 20:24:09 -05:00
2021-05-31 22:48:23 -04:00
2021-05-21 16:59:33 -04:00
2021-03-24 23:03:43 -04:00
2020-10-14 15:15:35 -07:00
2021-09-02 15:09:46 -07:00
2021-09-02 15:09:46 -07:00
2020-02-24 15:01:57 -05:00
2021-08-23 12:54:30 -06:00
2021-04-13 00:20:48 -04:00
2021-08-16 13:33:24 -04:00