Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4d765f4 authored by Mike Christie's avatar Mike Christie Committed by Greg Kroah-Hartman
Browse files

scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress 

[ Upstream commit f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3 ]

If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,
userspace could be accessing the host's ipaddress attr. If we then free the
session via iscsi_session_teardown() while userspace is still accessing the
session we will hit a use after free bug.

Set the tcp_sw_host->session after we have completed session creation and
can no longer fail.

Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com


Signed-off-by: default avatarMike Christie <michael.christie@oracle.com>
Reviewed-by: default avatarLee Duncan <lduncan@suse.com>
Acked-by: default avatarDing Hui <dinghui@sangfor.com.cn>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 6122ce1d

drivers/scsi/iscsi_tcp.c

+6 −3
Original line number Diff line number Diff line
@@ -770,7 +770,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, 
				       enum iscsi_host_param param, char *buf)

{

	struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(shost);

	struct iscsi_session *session = tcp_sw_host->session;

	struct iscsi_session *session;

	struct iscsi_conn *conn;

	struct iscsi_tcp_conn *tcp_conn;

	struct iscsi_sw_tcp_conn *tcp_sw_conn;
@@ -779,6 +779,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, 


	switch (param) {

	case ISCSI_HOST_PARAM_IPADDRESS:

		session = tcp_sw_host->session;

		if (!session)

			return -ENOTCONN;
@@ -867,12 +868,14 @@ iscsi_sw_tcp_session_create(struct iscsi_endpoint *ep, uint16_t cmds_max, 
	if (!cls_session)

		goto remove_host;

	session = cls_session->dd_data;

	tcp_sw_host = iscsi_host_priv(shost);

	tcp_sw_host->session = session;



	shost->can_queue = session->scsi_cmds_max;

	if (iscsi_tcp_r2tpool_alloc(session))

		goto remove_session;



	/* We are now fully setup so expose the session to sysfs. */

	tcp_sw_host = iscsi_host_priv(shost);

	tcp_sw_host->session = session;

	return cls_session;



remove_session: