Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00ee0e07 authored by Mike Christie's avatar Mike Christie Committed by Greg Kroah-Hartman
Browse files

iscsi target: fix session creation failure handling 



commit 26abc916a898d34c5ad159315a2f683def3c5555 upstream.

The problem is that iscsi_login_zero_tsih_s1 sets conn->sess early in
iscsi_login_set_conn_values. If the function fails later like when we
alloc the idr it does kfree(sess) and leaves the conn->sess pointer set.
iscsi_login_zero_tsih_s1 then returns -Exyz and we then call
iscsi_target_login_sess_out and access the freed memory.

This patch has iscsi_login_zero_tsih_s1 either completely setup the
session or completely tear it down, so later in
iscsi_target_login_sess_out we can just check for it being set to the
connection.

Cc: stable@vger.kernel.org
Fixes: 0957627a ("iscsi-target: Fix sess allocation leak in...")
Signed-off-by: default avatarMike Christie <mchristi@redhat.com>
Acked-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarMatthew Wilcox <willy@infradead.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6d70dea5

drivers/target/iscsi/iscsi_target_login.c

+21 −14
Original line number Diff line number Diff line
@@ -333,8 +333,7 @@ static int iscsi_login_zero_tsih_s1( 
		pr_err("idr_alloc() for sess_idr failed\n");

		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,

				ISCSI_LOGIN_STATUS_NO_RESOURCES);

		kfree(sess);

		return -ENOMEM;

		goto free_sess;

	}



	sess->creation_time = get_jiffies_64();
@@ -350,20 +349,28 @@ static int iscsi_login_zero_tsih_s1( 
				ISCSI_LOGIN_STATUS_NO_RESOURCES);

		pr_err("Unable to allocate memory for"

				" struct iscsi_sess_ops.\n");

		kfree(sess);

		return -ENOMEM;

		goto remove_idr;

	}



	sess->se_sess = transport_init_session(TARGET_PROT_NORMAL);

	if (IS_ERR(sess->se_sess)) {

		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,

				ISCSI_LOGIN_STATUS_NO_RESOURCES);

		kfree(sess->sess_ops);

		kfree(sess);

		return -ENOMEM;

		goto free_ops;

	}



	return 0;



free_ops:

	kfree(sess->sess_ops);

remove_idr:

	spin_lock_bh(&sess_idr_lock);

	idr_remove(&sess_idr, sess->session_index);

	spin_unlock_bh(&sess_idr_lock);

free_sess:

	kfree(sess);

	conn->sess = NULL;

	return -ENOMEM;

}



static int iscsi_login_zero_tsih_s2(
@@ -1152,13 +1159,13 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn, 
				   ISCSI_LOGIN_STATUS_INIT_ERR);

	if (!zero_tsih || !conn->sess)

		goto old_sess_out;

	if (conn->sess->se_sess)



	transport_free_session(conn->sess->se_sess);

	if (conn->sess->session_index != 0) {



	spin_lock_bh(&sess_idr_lock);

	idr_remove(&sess_idr, conn->sess->session_index);

	spin_unlock_bh(&sess_idr_lock);

	}



	kfree(conn->sess->sess_ops);

	kfree(conn->sess);

	conn->sess = NULL;