• Bart Van Assche's avatar
    scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough · 6c05aea6
    Bart Van Assche authored
    [ Upstream commit ad669505 ]
    
    A session must only be released after all code that accesses the session
    structure has finished. Make sure that this is the case by introducing a
    new command counter per session that is only decremented after the
    .release_cmd() callback has finished. This patch fixes the following crash:
    
    BUG: KASAN: use-after-free in do_raw_spin_lock+0x1c/0x130
    Read of size 4 at addr ffff8801534b16e4 by task rmdir/14805
    CPU: 16 PID: 14805 Comm: rmdir Not tainted 4.18.0-rc2-dbg+ #5
    Call Trace:
    dump_stack+0xa4/0xf5
    print_address_description+0x6f/0x270
    kasan_report+0x241/0x360
    __asan_load4+0x78/0x80
    do_raw_spin_lock+0x1c/0x130
    _raw_spin_lock_irqsave+0x52/0x60
    srpt_set_ch_state+0x27/0x70 [ib_srpt]
    srpt_disconnect_ch+0x1b/0xc0 [ib_srpt]
    srpt_close_session+0xa8/0x260 [ib_srpt]
    target_shutdown_sessions+0x170/0x180 [target_core_mod]
    core_tpg_del_initiator_node_acl+0xf3/0x200 [target_core_mod]
    target_fabric_nacl_base_release+0x25/0x30 [target_core_mod]
    config_item_release+0x9c/0x110 [configfs]
    config_item_put+0x26/0x30 [configfs]
    configfs_rmdir+0x3b8/0x510 [configfs]
    vfs_rmdir+0xb3/0x1e0
    do_rmdir+0x262/0x2c0
    do_syscall_64+0x77/0x230
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Cc: Nicholas Bellinger <nab@linux-iscsi.org>
    Cc: Mike Christie <mchristi@redhat.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: David Disseldorp <ddiss@suse.de>
    Cc: Hannes Reinecke <hare@suse.de>
    Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen's avatarMartin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    6c05aea6
Name
Last commit
Last update
..
iscsi Loading commit data...
loopback Loading commit data...
sbp Loading commit data...
tcm_fc Loading commit data...
Kconfig Loading commit data...
Makefile Loading commit data...
target_core_alua.c Loading commit data...
target_core_alua.h Loading commit data...
target_core_configfs.c Loading commit data...
target_core_device.c Loading commit data...
target_core_fabric_configfs.c Loading commit data...
target_core_fabric_lib.c Loading commit data...
target_core_file.c Loading commit data...
target_core_file.h Loading commit data...
target_core_hba.c Loading commit data...
target_core_iblock.c Loading commit data...
target_core_iblock.h Loading commit data...
target_core_internal.h Loading commit data...
target_core_pr.c Loading commit data...
target_core_pr.h Loading commit data...
target_core_pscsi.c Loading commit data...
target_core_pscsi.h Loading commit data...
target_core_rd.c Loading commit data...
target_core_rd.h Loading commit data...
target_core_sbc.c Loading commit data...
target_core_spc.c Loading commit data...
target_core_stat.c Loading commit data...
target_core_tmr.c Loading commit data...
target_core_tpg.c Loading commit data...
target_core_transport.c Loading commit data...
target_core_ua.c Loading commit data...
target_core_ua.h Loading commit data...
target_core_user.c Loading commit data...
target_core_xcopy.c Loading commit data...
target_core_xcopy.h Loading commit data...