Re: [PATCH] scsi: iscsi: fix inappropriate use of put_device
On Fri, 20 Nov 2020 15:48:52 +0800, Qinglang Miao wrote: > kfree(conn) is called inside put_device(>dev) so that > another one would cause use-after-free. Besides, device_unregister > should be used here rather than put_device. Applied to 5.11/scsi-queue, thanks! [1/1] scsi: iscsi: fix inappropriate use of put_device https://git.kernel.org/mkp/scsi/c/6dc1c7ab6f04 -- Martin K. Petersen Oracle Linux Engineering
Re: [PATCH] scsi: iscsi: fix inappropriate use of put_device
On 11/20/20 1:48 AM, Qinglang Miao wrote: > kfree(conn) is called inside put_device(>dev) so that > another one would cause use-after-free. Besides, device_unregister > should be used here rather than put_device. > > Fixes: f3c893e3dbb5 ("scsi: iscsi: Fail session and connection on transport > registration failure") > Reported-by: Hulk Robot > Signed-off-by: Qinglang Miao > --- > drivers/scsi/scsi_transport_iscsi.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/scsi/scsi_transport_iscsi.c > b/drivers/scsi/scsi_transport_iscsi.c > index 2eb3e4f93..2e68c0a87 100644 > --- a/drivers/scsi/scsi_transport_iscsi.c > +++ b/drivers/scsi/scsi_transport_iscsi.c > @@ -2313,7 +2313,9 @@ iscsi_create_conn(struct iscsi_cls_session *session, > int dd_size, uint32_t cid) > return conn; > > release_conn_ref: > - put_device(>dev); > + device_unregister(>dev); > + put_device(>dev); > + return NULL; > release_parent_ref: > put_device(>dev); > free_conn: > Reviewed-by: Mike Christie
[PATCH] scsi: iscsi: fix inappropriate use of put_device
kfree(conn) is called inside put_device(>dev) so that another one would cause use-after-free. Besides, device_unregister should be used here rather than put_device. Fixes: f3c893e3dbb5 ("scsi: iscsi: Fail session and connection on transport registration failure") Reported-by: Hulk Robot Signed-off-by: Qinglang Miao --- drivers/scsi/scsi_transport_iscsi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c index 2eb3e4f93..2e68c0a87 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2313,7 +2313,9 @@ iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid) return conn; release_conn_ref: - put_device(>dev); + device_unregister(>dev); + put_device(>dev); + return NULL; release_parent_ref: put_device(>dev); free_conn: -- 2.23.0