Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp2112967pxf; Sat, 20 Mar 2021 05:02:06 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzhMz4P5m08WZlBbrTi00PAn7i5CFaN6NnZoCN2ulZDd66WUxizh0ihk4AXjkWKYlYVfIhE X-Received: by 2002:a17:906:c24b:: with SMTP id bl11mr9587378ejb.80.1616241726400; Sat, 20 Mar 2021 05:02:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1616241726; cv=none; d=google.com; s=arc-20160816; b=xfK0XGSF2lVHntuLq+Zkxy7i/jz+Fdcjt6ycu6bL6RrailExPg2UEYUn55rrmxmlyH 9q8KXV2+WPbPVF0j0eQzNiVMYZPf7y65JcC8RkX9dZzYtcS8sDhV2T32LPbvXraynGc/ LuxXJoObEGj84evfW0GzVdlqVEGOLg9s+6BAyKPzplyx6UgxQlEvWGciRRfT7TIEsrdI X++WrfBYUIAyrDTisrsKq7Kn9VdCcCwTfiY7csMMrs8uVZ31Onf3ORia0B6XbWf1JD+f MoOA/Vp1Fe1PetkzbZJ8NP9LgrKetQ4M+NvuXBY+juIo2hM6gIOUFnedKPK0MIVo/OGd l4IQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:message-id:date:subject:cc:to:from; bh=NSH6DhJhxbNbQbsIHW5qKjRRMpT7Wua33qXcN94D4wo=; b=T2xKGMJFgvTpO73R+LF7t9b6MKj1PszegEVaIypyuyxEaKCdBT4HpuALF1/06oUlCz ssoppnpEXjA9spRWvGGQZwCgllJJy/xc/Xiif6ku/DgU7h4SLGRymFpHpHm4elr+3fNR 0jH0uKM2fFaCsBKWYwYtked0XQlQXTG/m/smcoS346jWciHi1T1G9p1109Q6GQJ2IUtS 7fgtjGaxMMacfaqkhzkbyyUW1Y+7vB0D67EXozXzYnVAOms93cUkNt3hTaE7jWqSO1/g ALsmn6vvq2JCAyYFH87VcAO+/38NTVMMoBbo9gwu01Oa+ATxHh0n1PeGhad+S9TTS9yF TarQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id p16si6336567edu.606.2021.03.20.05.01.44; Sat, 20 Mar 2021 05:02:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230131AbhCTMAY (ORCPT + 99 others); Sat, 20 Mar 2021 08:00:24 -0400 Received: from szxga05-in.huawei.com ([45.249.212.191]:14042 "EHLO szxga05-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229780AbhCTMAR (ORCPT ); Sat, 20 Mar 2021 08:00:17 -0400 Received: from DGGEMS407-HUB.china.huawei.com (unknown [172.30.72.58]) by szxga05-in.huawei.com (SkyGuard) with ESMTP id 4F2ZCW6PxPzPl6R; Sat, 20 Mar 2021 16:47:51 +0800 (CST) Received: from huawei.com (10.175.124.27) by DGGEMS407-HUB.china.huawei.com (10.3.19.207) with Microsoft SMTP Server id 14.3.498.0; Sat, 20 Mar 2021 16:50:10 +0800 From: Wu Bo To: , , , , , , , , CC: , , Subject: [PATCH] scsi: iscsi_tcp: Fix use-after-free when do get_host_param Date: Sat, 20 Mar 2021 17:08:04 +0800 Message-ID: <1616231284-463105-1-git-send-email-wubo40@huawei.com> X-Mailer: git-send-email 1.8.3.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.124.27] X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When logout of iscsi session, to do destroy session process, tcp_sw_host->session is not set to NULL. Get host parameters access to tcp_sw_host->session at the same time, but the session has been released at this time. [29844.848044] sd 2:0:0:1: [sdj] Synchronizing SCSI cache [29844.923745] scsi 2:0:0:1: alua: Detached [29844.927840] ================================================================== [29844.927861] BUG: KASAN: use-after-free in iscsi_sw_tcp_host_get_param+0xf4/0x218 [iscsi_tcp] [29844.927864] Read of size 8 at addr ffff80002c0b8f68 by task iscsiadm/523945 [29844.927871] CPU: 1 PID: 523945 Comm: iscsiadm Kdump: loaded Not tainted 4.19.90.kasan.aarch64 [29844.927873] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [29844.927875] Call trace: [29844.927884] dump_backtrace+0x0/0x270 [29844.927886] show_stack+0x24/0x30 [29844.927895] dump_stack+0xc4/0x120 [29844.927902] print_address_description+0x68/0x278 [29844.927904] kasan_report+0x20c/0x338 [29844.927906] __asan_load8+0x88/0xb0 [29844.927910] iscsi_sw_tcp_host_get_param+0xf4/0x218 [iscsi_tcp] [29844.927932] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0x84/0xa0 [scsi_transport_iscsi] [29844.927938] dev_attr_show+0x48/0x90 [29844.927943] sysfs_kf_seq_show+0x100/0x1e0 [29844.927946] kernfs_seq_show+0x88/0xa0 [29844.927949] seq_read+0x164/0x748 [29844.927951] kernfs_fop_read+0x204/0x308 [29844.927956] __vfs_read+0xd4/0x2d8 [29844.927958] vfs_read+0xa8/0x198 [29844.927960] ksys_read+0xd0/0x180 [29844.927962] __arm64_sys_read+0x4c/0x60 [29844.927966] el0_svc_common+0xa8/0x230 [29844.927969] el0_svc_handler+0xdc/0x138 [29844.927971] el0_svc+0x10/0x218 [29844.928063] Freed by task 53358: [29844.928066] __kasan_slab_free+0x120/0x228 [29844.928068] kasan_slab_free+0x10/0x18 [29844.928069] kfree+0x98/0x278 [29844.928083] iscsi_session_release+0x84/0xa0 [scsi_transport_iscsi] [29844.928085] device_release+0x4c/0x100 [29844.928089] kobject_put+0xc4/0x288 [29844.928091] put_device+0x24/0x30 [29844.928105] iscsi_free_session+0x60/0x70 [scsi_transport_iscsi] [29844.928112] iscsi_session_teardown+0x134/0x158 [libiscsi] [29844.928116] iscsi_sw_tcp_session_destroy+0x7c/0xd8 [iscsi_tcp] [29844.928129] iscsi_if_rx+0x1538/0x1f00 [scsi_transport_iscsi] [29844.928131] netlink_unicast+0x338/0x3c8 [29844.928133] netlink_sendmsg+0x51c/0x588 [29844.928135] sock_sendmsg+0x74/0x98 [29844.928137] ___sys_sendmsg+0x434/0x470 [29844.928139] __sys_sendmsg+0xd4/0x148 [29844.928141] __arm64_sys_sendmsg+0x50/0x60 [29844.928143] el0_svc_common+0xa8/0x230 [29844.928146] el0_svc_handler+0xdc/0x138 [29844.928147] el0_svc+0x10/0x218 [29844.928148] [29844.928150] The buggy address belongs to the object at ffff80002c0b8880#012 which belongs to the cache kmalloc-2048 of size 2048 [29844.928153] The buggy address is located 1768 bytes inside of#012 2048-byte region [ffff80002c0b8880, ffff80002c0b9080) [29844.928154] The buggy address belongs to the page: [29844.928158] page:ffff7e0000b02e00 count:1 mapcount:0 mapping:ffff8000d8402600 index:0x0 compound_mapcount: 0 [29844.928902] flags: 0x7fffe0000008100(slab|head) [29844.929215] raw: 07fffe0000008100 ffff7e0003535e08 ffff7e00024a9408 ffff8000d8402600 [29844.929217] raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000 [29844.929219] page dumped because: kasan: bad access detected [29844.929219] [29844.929221] Memory state around the buggy address: [29844.929223] ffff80002c0b8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [29844.929225] ffff80002c0b8e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [29844.929227] >ffff80002c0b8f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [29844.929228] ^ [29844.929230] ffff80002c0b8f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [29844.929232] ffff80002c0b9000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [29844.929232] ================================================================== [29844.929234] Disabling lock debugging due to kernel taint [29844.969534] scsi host2: iSCSI Initiator over TCP/IP Fixes: a79af8a64d39 ("[SCSI] iscsi_tcp: use iscsi_conn_get_addr_param libiscsi function") Signed-off-by: Wu Bo Signed-off-by: WenChao Hao --- drivers/scsi/iscsi_tcp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c index dd33ce0..98d782d 100644 --- a/drivers/scsi/iscsi_tcp.c +++ b/drivers/scsi/iscsi_tcp.c @@ -901,10 +901,12 @@ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session) { struct Scsi_Host *shost = iscsi_session_to_shost(cls_session); struct iscsi_session *session = cls_session->dd_data; + struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(shost); if (WARN_ON_ONCE(session->leadconn)) return; + tcp_sw_host->session = NULL; iscsi_tcp_r2tpool_free(cls_session->dd_data); iscsi_session_teardown(cls_session); -- 1.8.3.1