iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/scsi
History
Lixiaokeng 8b36aa5af4 scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() 
[ Upstream commit 1b8d0300a3e9f216ae4901bab886db7299899ec6 ]

|- iscsi_if_destroy_conn            |-dev_attr_show
 |-iscsi_conn_teardown
  |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param

  |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
  |-kfree(conn->local_ipaddr)
                                       ==>|-read persistent_address
                                       ==>|-read local_ipaddr
  |-spin_unlock_bh

When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
UAF may be triggered.

Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com
Reported-by: Lu Tixiong <lutianxiong@huawei.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Lixiaokeng <lixiaokeng@huawei.com>
Signed-off-by: Linfeilong <linfeilong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-11 15:23:33 +01:00
..
aacraid
scsi: aacraid: Fix error handling paths in aac_probe_one()
2020-10-01 13:17:56 +02:00
aic7xxx
scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
2021-07-25 14:35:12 +02:00
aic94xx
scsi: libsas: Add LUN number check in .slave_alloc callback
2021-07-25 14:35:13 +02:00
arcmsr
treewide: Add SPDX license identifier - Makefile/Kconfig
2019-05-21 10:50:46 +02:00
arm
scsi: eesox: Fix different dev_id between request_irq() and free_irq()
2020-08-19 08:16:09 +02:00
be2iscsi
scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe()
2021-07-20 16:10:53 +02:00
bfa
scsi: bfa: Fix error return in bfad_pci_init()
2020-10-29 09:57:57 +01:00
bnx2fc
scsi: bnx2fc: Return failure if io_req is already in ABTS processing
2021-06-16 11:59:35 +02:00
bnx2i
scsi: iscsi: Fix shost->max_id use
2021-07-20 16:10:43 +02:00
csiostor
scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
2021-11-17 09:48:43 +01:00
cxgbi
scsi: iscsi: Fix shost->max_id use
2021-07-20 16:10:43 +02:00
cxlflash
scsi: cxlflash: Fix error return code in cxlflash_probe()
2020-10-01 13:18:02 +02:00
device_handler
scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
2021-08-26 08:36:14 -04:00
dpt
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
esas2r
scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
2020-01-23 08:22:58 +01:00
fcoe
scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
2020-09-03 11:26:47 +02:00
fnic
scsi: fnic: Fix memleak in vnic_dev_init_devcmd2
2021-02-07 15:35:48 +01:00
hisi_sas
scsi: libsas: Add LUN number check in .slave_alloc callback
2021-07-25 14:35:13 +02:00
ibmvscsi
scsi: ibmvfc: Fix invalid state machine BUG_ON()
2021-05-14 09:44:25 +02:00
ibmvscsi_tgt
scsi: ibmvscsi_tgt: Mark expected switch fall-throughs
2019-07-30 15:59:53 -04:00
isci
scsi: libsas: Add LUN number check in .slave_alloc callback
2021-07-25 14:35:13 +02:00
libfc
scsi: libfc: Fix array index out of bound exception
2021-07-25 14:35:13 +02:00
libsas
scsi: libsas: Add LUN number check in .slave_alloc callback
2021-07-25 14:35:13 +02:00
lpfc
scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
2022-01-05 12:37:44 +01:00
megaraid
scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
2021-08-26 08:36:14 -04:00
mpt3sas
scsi: mpt3sas: Fix kernel panic during drive powercycle test
2021-12-01 09:23:32 +01:00
mvsas
scsi: libsas: Add LUN number check in .slave_alloc callback
2021-07-25 14:35:13 +02:00
pcmcia
scsi: fdomain: Fix error return code in fdomain_probe()
2021-09-22 12:26:24 +02:00
pm8001
scsi: libsas: Add LUN number check in .slave_alloc callback
2021-07-25 14:35:13 +02:00
qedf
scsi: qedf: Fix error codes in qedf_alloc_global_queues()
2021-09-22 12:26:24 +02:00
qedi
scsi: qedi: Fix error codes in qedi_alloc_global_queues()
2021-09-22 12:26:24 +02:00
qla2xxx
scsi: qla2xxx: Turn off target reset during issue_lip
2021-11-17 09:48:46 +01:00
qla4xxx
scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()'
2020-10-29 09:57:36 +01:00
smartpqi
scsi: smartpqi: Fix an error code in pqi_get_raid_map()
2021-09-22 12:26:24 +02:00
snic
scsi: snic: no need to check return value of debugfs_create functions
2019-01-29 00:40:54 -05:00
sym53c8xx_2
scsi: sym53c8xx_2: remove redundant assignment to retv
2019-08-12 21:58:07 -04:00
ufs
scsi: ufs: Fix tm request when non-fatal error happens
2021-11-21 13:38:50 +01:00
.gitignore
…
3w-9xxx.c
scsi: 3w-9xxx: fix calls to dma_set_mask_and_coherent()
2019-02-25 21:37:25 -05:00
3w-9xxx.h
…
3w-sas.c
SCSI fixes on 20190302
2019-03-02 11:39:54 -08:00
3w-sas.h
…
3w-xxxx.c
scsi: 3w-xxxx: fix indentation issue, add missing tab
2018-12-19 21:54:07 -05:00
3w-xxxx.h
…
53c700_d.h_shipped
…
53c700.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
53c700.h
…
53c700.scr
…
a100u2w.c
cross-tree: phase out dma_zalloc_coherent()
2019-01-08 07:58:37 -05:00
a100u2w.h
…
a2091.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
a2091.h
…
a3000.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
a3000.h
…
a4000t.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
advansys.c
scsi: advansys: Fix kernel pointer leak
2021-11-26 10:47:15 +01:00
aha152x.c
SCSI sg on 20190709
2019-07-11 15:17:41 -07:00
aha152x.h
…
aha1542.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
aha1542.h
…
aha1740.c
scsi: flip the default on use_clustering
2018-12-18 23:13:12 -05:00
aha1740.h
…
am53c974.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
atari_scsi.c
scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
2020-01-04 19:18:10 +01:00
atp870u.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
atp870u.h
…
BusLogic.c
scsi: BusLogic: Fix missing pr_cont() use
2021-09-22 12:26:37 +02:00
BusLogic.h
scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
2021-06-03 08:59:11 +02:00
bvme6000_scsi.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
ch.c
scsi: ch: Make it possible to open a ch device multiple times again
2019-10-09 23:39:35 -04:00
constants.c
…
dc395x.c
scsi: dc395: Fix error case unwinding
2021-11-17 09:48:41 +01:00
dc395x.h
…
dmx3191d.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
dpt_i2o.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
dpti.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
esp_scsi.c
SCSI sg on 20190709
2019-07-11 15:17:41 -07:00
esp_scsi.h
scsi: esp: use sg helper to iterate over scatterlist
2019-06-20 15:21:33 -04:00
fdomain_isa.c
scsi: fdomain_isa: use CFG1_IRQ_MASK
2019-07-30 12:18:24 -04:00
fdomain_pci.c
scsi: fdomain: Resurrect driver - PCI support
2019-06-18 19:46:18 -04:00
fdomain.c
scsi: fdomain: use BSTAT_{MSG|CMD|IO} in fdomain_work()
2019-07-30 12:17:28 -04:00
fdomain.h
scsi: fdomain: Add register definitions
2019-06-18 19:46:22 -04:00
FlashPoint.c
scsi: FlashPoint: Rename si_flags field
2021-07-14 16:53:41 +02:00
g_NCR5380.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
gdth_ioctl.h
scsi: gdth: remove dead code under #ifdef GDTH_IOCTL_PROC
2019-01-08 21:58:35 -05:00
gdth_proc.c
scsi: gdth: use generic DMA API
2019-01-08 21:58:35 -05:00
gdth_proc.h
scsi: gdth: remove gdth_{alloc,free}_ioctl
2019-01-08 21:57:42 -05:00
gdth.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 148
2019-05-30 11:25:18 -07:00
gdth.h
scsi: gdth: remove ISA and EISA support
2019-01-08 21:58:35 -05:00
gvp11.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
gvp11.h
…
hosts.c
scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
2021-10-27 09:54:29 +02:00
hpsa_cmd.h
SCSI misc on 20190709
2019-07-11 15:14:01 -07:00
hpsa.c
scsi: hpsa: Fix memory leak in hpsa_init_one()
2020-11-18 19:20:22 +01:00
hpsa.h
scsi: hpsa: correct device resets
2019-06-18 19:46:18 -04:00
hptiop.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 285
2019-06-05 17:36:37 +02:00
hptiop.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 285
2019-06-05 17:36:37 +02:00
imm.c
SCSI sg on 20190709
2019-07-11 15:17:41 -07:00
imm.h
…
initio.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 18
2019-05-21 11:28:46 +02:00
initio.h
…
ipr.c
scsi: ipr: Fix softlockup when rescanning devices in petitboot
2020-04-01 11:01:54 +02:00
ipr.h
scsi: ipr: Fix softlockup when rescanning devices in petitboot
2020-04-01 11:01:54 +02:00
ips.c
scsi: remove the use_clustering flag
2018-12-18 23:19:21 -05:00
ips.h
…
iscsi_boot_sysfs.c
scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
2020-06-24 17:50:37 +02:00
iscsi_tcp.c
scsi: iscsi: Don't destroy session if there are outstanding connections
2020-02-24 08:36:50 +01:00
iscsi_tcp.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157
2019-05-30 11:26:37 -07:00
jazz_esp.c
scsi: jazz_esp: Add IRQ check
2021-05-14 09:44:25 +02:00
Kconfig
scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled
2020-07-22 09:32:57 +02:00
lasi700.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
libiscsi_tcp.c
SCSI misc on 20190709
2019-07-11 15:14:01 -07:00
libiscsi.c
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
2022-01-11 15:23:33 +01:00
mac53c94.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
mac53c94.h
…
mac_esp.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
mac_scsi.c
scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
2020-01-04 19:18:10 +01:00
Makefile
scsi: remove pointless $(MODVERDIR)/$(obj)/53c700.ver
2019-07-17 22:39:27 +09:00
megaraid.c
scsi: megaraid: disable device when probe failed after enabled device
2019-09-23 23:09:42 -04:00
megaraid.h
…
mesh.c
scsi: mesh: Fix panic after host or bus reset
2020-08-19 08:16:15 +02:00
mesh.h
…
mvme16x_scsi.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
mvme147.c
scsi: flip the default on use_clustering
2018-12-18 23:13:12 -05:00
mvme147.h
…
mvumi.c
scsi: mvumi: Fix error return in mvumi_io_attach()
2020-10-29 09:58:04 +01:00
mvumi.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 167
2019-05-30 11:26:39 -07:00
myrb.c
SCSI misc on 20181224
2018-12-28 14:48:06 -08:00
myrb.h
…
myrs.c
scsi: myrs: Fix a double free in myrs_cleanup()
2021-03-24 11:26:40 +01:00
myrs.h
…
ncr53c8xx.c
scsi: ncr53c8xx: Mark expected switch fall-through
2019-08-07 21:53:23 -04:00
ncr53c8xx.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
NCR5380.c
scsi: NCR5380: Add disconnect_mask module parameter
2020-01-04 19:18:16 +01:00
NCR5380.h
Revert "scsi: ncr5380: Increase register polling limit"
2019-06-20 15:37:02 -04:00
nsp32_debug.c
…
nsp32_io.h
…
nsp32.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 118
2019-05-24 17:39:02 +02:00
nsp32.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 118
2019-05-24 17:39:02 +02:00
pmcraid.c
scsi: pmcraid: Fix a typo - pcmraid --> pmcraid
2019-08-12 21:57:13 -04:00
pmcraid.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
ppa.c
scsi: ppa: use sg helper to iterate over scatterlist
2019-06-20 15:21:33 -04:00
ppa.h
…
ps3rom.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 164
2019-05-30 11:26:38 -07:00
qla1280.c
qla1280: remove SGI SN2 support
2019-08-16 11:33:56 -07:00
qla1280.h
qla1280: remove SGI SN2 support
2019-08-16 11:33:56 -07:00
qlogicfas408.c
scsi: qlogicfas408: clean up a couple of indentation issues
2019-03-19 17:11:37 -04:00
qlogicfas408.h
…
qlogicfas.c
scsi: remove the use_clustering flag
2018-12-18 23:19:21 -05:00
qlogicpti.c
scsi: qlogicpti: Mark expected switch fall-throughs
2019-08-07 21:32:53 -04:00
qlogicpti.h
scsi: qlogicpti: Use of_node_name_eq for node name comparisons
2019-02-13 22:07:03 -05:00
raid_class.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 437
2019-06-05 17:37:17 +02:00
script_asm.pl
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
scsi_common.c
…
scsi_debug.c
scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
2021-12-22 09:29:40 +01:00
scsi_debugfs.c
scsi: scsi_debugfs: Use for_each_set_bit to simplify code
2019-07-30 12:42:55 -04:00
scsi_debugfs.h
scsi: core: add SPDX tags to scsi midlayer files missing licensing information
2019-05-21 06:16:21 -04:00
scsi_devinfo.c
scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V
2021-06-18 09:58:59 +02:00
scsi_dh.c
scsi: dh: Add Fujitsu device to devinfo and dh lists
2020-07-29 10:18:27 +02:00
scsi_error.c
scsi: core: save/restore command resid for error handling
2019-10-03 21:43:04 -04:00
scsi_ioctl.c
scsi: core: add SPDX tags to scsi midlayer files missing licensing information
2019-05-21 06:16:21 -04:00
scsi_lib_dma.c
…
scsi_lib.c
scsi: core: Retry I/O for Notify (Enable Spinup) Required error
2021-07-14 16:53:48 +02:00
scsi_logging.c
scsi: core: Reduce memory required for SCSI logging
2019-08-07 21:47:29 -04:00
scsi_logging.h
…
scsi_netlink.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
scsi_pm.c
scsi: pm: Balance pm_only counter of request queue during system resume
2020-06-07 13:18:50 +02:00
scsi_priv.h
scsi: sd: Rely on the driver core for asynchronous probing
2019-06-18 19:46:17 -04:00
scsi_proc.c
drivers: Add generic helper to match any device
2019-07-30 13:07:42 +02:00
scsi_sas_internal.h
…
scsi_scan.c
scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
2021-08-26 08:36:14 -04:00
scsi_sysctl.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 209
2019-05-30 11:29:53 -07:00
scsi_sysfs.c
scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
2021-12-01 09:23:33 +01:00
scsi_trace.c
scsi: core: scsi_trace: Use get_unaligned_be*()
2020-01-23 08:22:59 +01:00
scsi_transport_api.h
…
scsi_transport_fc.c
SCSI misc on 20190709
2019-07-11 15:14:01 -07:00
scsi_transport_iscsi.c
scsi: iscsi: Unblock session then wake up error handler
2021-12-08 09:01:09 +01:00
scsi_transport_sas.c
scsi: scsi_transport_sas: Fix memory leak when removing devices
2020-01-23 08:22:58 +01:00
scsi_transport_spi.c
scsi: scsi_transport_spi: Set RQF_PM for domain validation commands
2021-01-12 20:16:09 +01:00
scsi_transport_srp.c
scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
2021-04-21 12:56:14 +02:00
scsi.c
scsi: core: Put LLD module refcnt after SCSI device is released
2021-11-06 13:59:44 +01:00
scsi.h
…
scsicam.c
…
sd_dif.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 410
2019-06-05 17:37:14 +02:00
sd_zbc.c
scsi: sd_zbc: Fix sd_zbc_complete()
2019-11-05 23:17:53 -05:00
sd.c
scsi: sd: Free scsi_disk device via put_device()
2021-10-09 14:39:49 +02:00
sd.h
scsi: implement REQ_OP_ZONE_RESET_ALL
2019-08-04 21:41:29 -06:00
sense_codes.h
…
ses.c
scsi: ses: Fix unsigned comparison with less than zero
2021-10-17 10:42:34 +02:00
sg.c
scsi: sg: add sg_remove_request in sg_write
2020-05-20 08:20:07 +02:00
sgiwd93.c
scsi: remove the use_clustering flag
2018-12-18 23:19:21 -05:00
sim710.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
sni_53c710.c
scsi: sni_53c710: Add IRQ check
2021-05-14 09:44:25 +02:00
sr_ioctl.c
…
sr_vendor.c
scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled
2020-07-22 09:32:57 +02:00
sr.c
scsi: sr: Return correct event when media event code is 3
2021-08-12 13:20:56 +02:00
sr.h
…
st_options.h
…
st.c
scsi: st: Fix a use after free in st_open()
2021-04-07 14:47:39 +02:00
st.h
…
stex.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
storvsc_drv.c
scsi: storvsc: Correctly set number of hardware queues for IDE disk
2020-01-23 08:22:38 +01:00
sun3_scsi_vme.c
…
sun3_scsi.c
scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
2020-01-04 19:18:10 +01:00
sun3x_esp.c
scsi: sun3x_esp: Add IRQ check
2021-05-14 09:44:25 +02:00
sun_esp.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
virtio_scsi.c
scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
2021-10-17 10:42:34 +02:00
vmw_pvscsi.c
scsi: vmw_pvscsi: Set residual data length conditionally
2022-01-05 12:37:46 +01:00
vmw_pvscsi.h
…
wd33c93.c
scsi: wd33c93: Mark expected switch fall-through
2019-08-07 21:35:59 -04:00
wd33c93.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 118
2019-05-24 17:39:02 +02:00
wd719x.c
SCSI misc on 20190709
2019-07-11 15:14:01 -07:00
wd719x.h
…
xen-scsifront.c
scsi: xen-scsifront: remove DISABLE_CLUSTERING
2018-12-18 23:13:12 -05:00
zalon.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
zorro7xx.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
zorro_esp.c
scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane)
2020-01-04 19:17:37 +01:00