lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 358/717] scsi: iscsi: Fix inappropriate use of put_device()
    Date
    From: Qinglang Miao <miaoqinglang@huawei.com>

    [ Upstream commit 6dc1c7ab6f047f45b62986ffebc5324e86ed5f5a ]

    kfree(conn) is called inside put_device(&conn->dev) which could lead to
    use-after-free. In addition, device_unregister() should be used here rather
    than put_deviceO().

    Link: https://lore.kernel.org/r/20201120074852.31658-1-miaoqinglang@huawei.com
    Fixes: f3c893e3dbb5 ("scsi: iscsi: Fail session and connection on transport registration failure")
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Reviewed-by: Mike Christie <michael.christie@oracle.com>
    Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/scsi_transport_iscsi.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
    index 2eb3e4f9375a5..2e68c0a876986 100644
    --- a/drivers/scsi/scsi_transport_iscsi.c
    +++ b/drivers/scsi/scsi_transport_iscsi.c
    @@ -2313,7 +2313,9 @@ iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
    return conn;

    release_conn_ref:
    - put_device(&conn->dev);
    + device_unregister(&conn->dev);
    + put_device(&session->dev);
    + return NULL;
    release_parent_ref:
    put_device(&session->dev);
    free_conn:
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-28 15:59    [W:4.018 / U:1.224 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site