linux.git/drivers/scsi/libiscsi.c, branch v5.17

scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()

2021-12-23T04:03:59+00:00

|- iscsi_if_destroy_conn            |-dev_attr_show
 |-iscsi_conn_teardown
  |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param

  |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
  |-kfree(conn->local_ipaddr)
                                       ==>|-read persistent_address
                                       ==>|-read local_ipaddr
  |-spin_unlock_bh

When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
UAF may be triggered.

Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei.com
Reported-by: Lu Tixiong 
Reviewed-by: Mike Christie 
Reviewed-by: Lee Duncan 
Signed-off-by: Lixiaokeng 
Signed-off-by: Linfeilong 
Signed-off-by: Martin K. Petersen

scsi: libiscsi: Call scsi_done() directly

2021-10-17T01:28:48+00:00

Conditional statements are faster than indirect calls. Hence call
scsi_done() directly.

Link: https://lore.kernel.org/r/20211007202923.2174984-45-bvanassche@acm.org
Reviewed-by: Lee Duncan 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

Merge branch '5.15/scsi-fixes' into 5.16/scsi-staging

2021-10-12T15:58:12+00:00

Merge the 5.15/scsi-fixes branch into the staging tree to resolve UFS
conflict reported by sfr.

Signed-off-by: Martin K. Petersen

scsi: iscsi: Fix iscsi_task use after free

2021-10-05T03:40:11+00:00

Commit d39df158518c ("scsi: iscsi: Have abort handler get ref to conn")
added iscsi_get_conn()/iscsi_put_conn() calls during abort handling but
then also changed the handling of the case where we detect an already
completed task where we now end up doing a goto to the common put/cleanup
code. This results in a iscsi_task use after free, because the common
cleanup code will do a put on the iscsi_task.

This reverts the goto and moves the iscsi_get_conn() to after we've checked
if the iscsi_task is valid.

Link: https://lore.kernel.org/r/20211004210608.9962-1-michael.christie@oracle.com
Fixes: d39df158518c ("scsi: iscsi: Have abort handler get ref to conn")
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen

scsi: libiscsi: Move ehwait initialization to iscsi_session_setup()

2021-09-14T04:02:45+00:00

Commit ec29d0ac29be ("scsi: iscsi: Fix conn use after free during resets")
moved member ehwait from 'conn' to 'session', but left the initialization
of ehwait in iscsi_conn_setup().

Although a session can only have 1 conn currently, it is better to
initialize ehwait in iscsi_session_setup() in case we implement handling
multiple conns in the future.

Link: https://lore.kernel.org/r/20210911135159.20543-1-dinghui@sangfor.com.cn
Reviewed-by: Mike Christie 
Signed-off-by: Ding Hui 
Signed-off-by: Martin K. Petersen

Merge branch '5.14/scsi-result' into 5.14/scsi-staging

2021-06-02T05:37:04+00:00

Include Hannes' SCSI command result rework in the staging branch.

[mkp: remove DRIVER_SENSE from mpi3mr]

Signed-off-by: Martin K. Petersen

scsi: iscsi: Move pool freeing

2021-06-02T05:28:22+00:00

This doesn't fix any bugs, but it makes more sense to free the pool after
we have removed the session. At that time we know nothing is touching any
of the session fields, because all devices have been removed and scans are
stopped.

Link: https://lore.kernel.org/r/20210525181821.7617-19-michael.christie@oracle.com
Reviewed-by: Lee Duncan 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen

scsi: iscsi: Hold task ref during TMF timeout handling

2021-06-02T05:28:22+00:00

For aborts, qedi needs to cleanup the FW then send the TMF from a worker
thread. While it's doing these the cmd could complete normally and the TMF
could time out. libiscsi would then complete the iscsi_task which will call
into the driver to cleanup the driver level resources while it still might
be accessing them for the cleanup/abort.

This has iscsi_eh_abort keep the iscsi_task ref if the TMF times out, so
qedi does not have to worry about if the task is being freed while in use
and does not need to get its own ref.

Link: https://lore.kernel.org/r/20210525181821.7617-18-michael.christie@oracle.com
Reviewed-by: Lee Duncan 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen

scsi: iscsi: Fix completion check during abort races

2021-06-02T05:28:21+00:00

We have a ref to the task being aborted, so SCp.ptr will never be NULL. We
need to use iscsi_task_is_completed to check for the completed state.

Link: https://lore.kernel.org/r/20210525181821.7617-16-michael.christie@oracle.com
Reviewed-by: Lee Duncan 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen

scsi: iscsi: Fix conn use after free during resets

2021-06-02T05:28:21+00:00

If we haven't done a unbind target call we can race where
iscsi_conn_teardown wakes up the EH thread and then frees the conn while
those threads are still accessing the conn ehwait.

We can only do one TMF per session so this just moves the TMF fields from
the conn to the session. We can then rely on the
iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call
to remove the target and it's devices, and know after that point there is
no device or scsi-ml callout trying to access the session.

Link: https://lore.kernel.org/r/20210525181821.7617-14-michael.christie@oracle.com
Reviewed-by: Lee Duncan 
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen