kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/target/iscsi
History
Maurizio Lombardi 3835e49e14 scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() 
[ Upstream commit 9411a89e9e ]

In iscsit_dec_conn_usage_count(), the function calls complete() while
holding the conn->conn_usage_lock. As soon as complete() is invoked, the
waiter (such as iscsit_close_connection()) may wake up and proceed to free
the iscsit_conn structure.

If the waiter frees the memory before the current thread reaches
spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function
attempts to release a lock within the already-freed connection structure.

Fix this by releasing the spinlock before calling complete().

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reported-by: Zhaojuan Guo <zguo@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Link: https://patch.msgid.link/20260112165352.138606-2-mlombard@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-02-11 13:41:53 +01:00
..
cxgbit move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
iscsi_target.c net: core: Convert inet_addr_is_any() to sockaddr_storage 2025-05-27 08:25:42 +02:00
iscsi_target.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_auth.c scsi: target: iscsi: Do not require target authentication 2022-07-26 22:13:29 -04:00
iscsi_target_auth.h scsi: target: iscsi: Rename iscsi_conn to iscsit_conn 2022-05-10 22:32:20 -04:00
iscsi_target_configfs.c scsi: target: iscsi: fix typos and formatting in lio_target messages 2025-09-15 21:54:09 -04:00
iscsi_target_datain_values.c scsi: target: iscsi: Rename iscsi_conn to iscsit_conn 2022-05-10 22:32:20 -04:00
iscsi_target_datain_values.h scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd 2022-05-10 22:32:20 -04:00
iscsi_target_device.c scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_device.h scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_erl0.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
iscsi_target_erl0.h scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_erl1.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
iscsi_target_erl1.h scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_erl2.c scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_erl2.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_login.c scsi: target: iscsi: switch to using the crc32c library 2024-12-01 17:23:02 -08:00
iscsi_target_login.h scsi: target: iscsi: switch to using the crc32c library 2024-12-01 17:23:02 -08:00
iscsi_target_nego.c scsi: target: iscsi: Fix typos 2025-02-12 22:01:34 -05:00
iscsi_target_nego.h scsi: target: Remove unused declarations 2024-08-22 21:15:21 -04:00
iscsi_target_nodeattrib.c scsi: target: iscsi: Control authentication per ACL 2022-06-07 21:55:11 -04:00
iscsi_target_nodeattrib.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
iscsi_target_parameters.c scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_parameters.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_seq_pdu_list.c scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_seq_pdu_list.h scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd 2022-05-10 22:32:20 -04:00
iscsi_target_stat.c scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_tmr.c scsi: target: iscsi: Use int type to store negative value 2025-09-09 22:05:36 -04:00
iscsi_target_tmr.h scsi: target: iscsi: Rename iscsi_conn to iscsit_conn 2022-05-10 22:32:20 -04:00
iscsi_target_tpg.c scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_tpg.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_transport.c scsi: target: Make iscsit_register_transport() return void 2020-08-04 20:56:56 -04:00
iscsi_target_util.c scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() 2026-02-11 13:41:53 +01:00
iscsi_target_util.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
Kconfig scsi: target: iscsi: switch to using the crc32c library 2024-12-01 17:23:02 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00