Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e10b512 authored by Khazhismel Kumykov's avatar Khazhismel Kumykov Committed by Martin K. Petersen
Browse files

scsi: libiscsi: Fix use-after-free race during iscsi_session_teardown 



Session attributes exposed through sysfs were freed before the device
was destroyed, resulting in a potential use-after-free. Free these
attributes after removing the device.

Signed-off-by: default avatarKhazhismel Kumykov <khazhy@google.com>
Acked-by: default avatarChris Leech <cleech@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 77082ca5

drivers/scsi/libiscsi.c

+4 −4
Original line number Diff line number Diff line
@@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup); 
/**

 * iscsi_session_teardown - destroy session, host, and cls_session

 * @cls_session: iscsi session

 *

 * The driver must have called iscsi_remove_session before

 * calling this.

 */

void iscsi_session_teardown(struct iscsi_cls_session *cls_session)

{
@@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) 


	iscsi_pool_free(&session->cmdpool);



	iscsi_remove_session(cls_session);



	kfree(session->password);

	kfree(session->password_in);

	kfree(session->username);
@@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) 
	kfree(session->portal_type);

	kfree(session->discovery_parent_type);



	iscsi_destroy_session(cls_session);

	iscsi_free_session(cls_session);



	iscsi_host_dec_session_cnt(shost);

	module_put(owner);

}