• Nicholas Bellinger's avatar
    iscsi-target: Fix use-after-free during TPG session shutdown · 3b9b1d90
    Nicholas Bellinger authored
    commit 417c20a9 upstream.
    
    This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
    where se_portal_group->session_lock was incorrectly released/re-acquired
    while walking the active se_portal_group->tpg_sess_list.
    
    The can result in a NULL pointer dereference when iscsit_close_session()
    shutdown happens in the normal path asynchronously to this code, causing
    a bogus dereference of an already freed list entry to occur.
    
    To address this bug, walk the session list checking for the same state
    as before, but move entries to a local list to avoid dropping the lock
    while walking the active list.
    
    As before, signal using iscsi_session->session_restatement=1 for those
    list entries to be released locally by iscsit_free_session() code.
    Reported-by: default avatarSunilkumar Nadumuttlu <sjn@datera.io>
    Cc: Sunilkumar Nadumuttlu <sjn@datera.io>
    Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
    3b9b1d90
iscsi_target.c 128 KB