• Bart Van Assche's avatar
    scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough · ad669505
    Bart Van Assche authored
    A session must only be released after all code that accesses the session
    structure has finished. Make sure that this is the case by introducing a
    new command counter per session that is only decremented after the
    .release_cmd() callback has finished. This patch fixes the following crash:
    
    BUG: KASAN: use-after-free in do_raw_spin_lock+0x1c/0x130
    Read of size 4 at addr ffff8801534b16e4 by task rmdir/14805
    CPU: 16 PID: 14805 Comm: rmdir Not tainted 4.18.0-rc2-dbg+ #5
    Call Trace:
    dump_stack+0xa4/0xf5
    print_address_description+0x6f/0x270
    kasan_report+0x241/0x360
    __asan_load4+0x78/0x80
    do_raw_spin_lock+0x1c/0x130
    _raw_spin_lock_irqsave+0x52/0x60
    srpt_set_ch_state+0x27/0x70 [ib_srpt]
    srpt_disconnect_ch+0x1b/0xc0 [ib_srpt]
    srpt_close_session+0xa8/0x260 [ib_srpt]
    target_shutdown_sessions+0x170/0x180 [target_core_mod]
    core_tpg_del_initiator_node_acl+0xf3/0x200 [target_core_mod]
    target_fabric_nacl_base_release+0x25/0x30 [target_core_mod]
    config_item_release+0x9c/0x110 [configfs]
    config_item_put+0x26/0x30 [configfs]
    configfs_rmdir+0x3b8/0x510 [configfs]
    vfs_rmdir+0xb3/0x1e0
    do_rmdir+0x262/0x2c0
    do_syscall_64+0x77/0x230
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Cc: Nicholas Bellinger <nab@linux-iscsi.org>
    Cc: Mike Christie <mchristi@redhat.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: David Disseldorp <ddiss@suse.de>
    Cc: Hannes Reinecke <hare@suse.de>
    Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
    Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
    ad669505
target_core_base.h 26.8 KB