Re: [Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown
Looks good to me, fixes up the code given that the comment there about
calling iscsi_remove_session wasn't being followed.
Thanks
Acked-by: Chris Leech
On Thu, Jul 13, 2017 at 09:11:21AM -0700, 'Khazhismel Kumykov' via open-iscsi
wrote:
> Session attributes exposed through sysfs were freed before the device
> was destroyed, resulting in a potential use-after-free. Free these
> attributes after removing the device.
>
> Signed-off-by: Khazhismel Kumykov
> ---
> drivers/scsi/libiscsi.c | 8
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
> index 42381adf0769..8696a51a5a0c 100644
> --- a/drivers/scsi/libiscsi.c
> +++ b/drivers/scsi/libiscsi.c
> @@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup);
> /**
> * iscsi_session_teardown - destroy session, host, and cls_session
> * @cls_session: iscsi session
> - *
> - * The driver must have called iscsi_remove_session before
> - * calling this.
> */
> void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
> {
> @@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session
> *cls_session)
>
> iscsi_pool_free(&session->cmdpool);
>
> + iscsi_remove_session(cls_session);
> +
> kfree(session->password);
> kfree(session->password_in);
> kfree(session->username);
> @@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session
> *cls_session)
> kfree(session->portal_type);
> kfree(session->discovery_parent_type);
>
> - iscsi_destroy_session(cls_session);
> + iscsi_free_session(cls_session);
> +
> iscsi_host_dec_session_cnt(shost);
> module_put(owner);
> }
> --
> 2.13.2.932.g7449e964c-goog
>
> --
> You received this message because you are subscribed to the Google Groups
> "open-iscsi" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to open-iscsi+unsubscr...@googlegroups.com.
> To post to this group, send email to open-iscsi@googlegroups.com.
> Visit this group at https://groups.google.com/group/open-iscsi.
> For more options, visit https://groups.google.com/d/optout.
--
You received this message because you are subscribed to the Google Groups
"open-iscsi" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to open-iscsi+unsubscr...@googlegroups.com.
To post to this group, send email to open-iscsi@googlegroups.com.
Visit this group at https://groups.google.com/group/open-iscsi.
For more options, visit https://groups.google.com/d/optout.
Re: [Patch v2 2/2] libiscsi: Remove iscsi_destroy_session
Thanks.
Acked-by: Chris Leech
On Thu, Jul 13, 2017 at 09:11:22AM -0700, 'Khazhismel Kumykov' via open-iscsi
wrote:
> iscsi_session_teardown was the only user of this function. Function
> currently is just short for iscsi_remove_session + iscsi_free_session.
>
> Signed-off-by: Khazhismel Kumykov
> ---
> drivers/scsi/scsi_transport_iscsi.c | 16
> include/scsi/scsi_transport_iscsi.h | 1 -
> 2 files changed, 17 deletions(-)
>
> diff --git a/drivers/scsi/scsi_transport_iscsi.c
> b/drivers/scsi/scsi_transport_iscsi.c
> index a424eaeafeb0..924ac408d8a9 100644
> --- a/drivers/scsi/scsi_transport_iscsi.c
> +++ b/drivers/scsi/scsi_transport_iscsi.c
> @@ -2210,22 +2210,6 @@ void iscsi_free_session(struct iscsi_cls_session
> *session)
> }
> EXPORT_SYMBOL_GPL(iscsi_free_session);
>
> -/**
> - * iscsi_destroy_session - destroy iscsi session
> - * @session: iscsi_session
> - *
> - * Can be called by a LLD or iscsi_transport. There must not be
> - * any running connections.
> - */
> -int iscsi_destroy_session(struct iscsi_cls_session *session)
> -{
> - iscsi_remove_session(session);
> - ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n");
> - iscsi_free_session(session);
> - return 0;
> -}
> -EXPORT_SYMBOL_GPL(iscsi_destroy_session);
> -
> /**
> * iscsi_create_conn - create iscsi class connection
> * @session: iscsi cls session
> diff --git a/include/scsi/scsi_transport_iscsi.h
> b/include/scsi/scsi_transport_iscsi.h
> index 6183d20a01fb..b266d2a3bcb1 100644
> --- a/include/scsi/scsi_transport_iscsi.h
> +++ b/include/scsi/scsi_transport_iscsi.h
> @@ -434,7 +434,6 @@ extern struct iscsi_cls_session
> *iscsi_create_session(struct Scsi_Host *shost,
> unsigned int target_id);
> extern void iscsi_remove_session(struct iscsi_cls_session *session);
> extern void iscsi_free_session(struct iscsi_cls_session *session);
> -extern int iscsi_destroy_session(struct iscsi_cls_session *session);
> extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session
> *sess,
> int dd_size, uint32_t cid);
> extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
> --
> 2.13.2.932.g7449e964c-goog
>
> --
> You received this message because you are subscribed to the Google Groups
> "open-iscsi" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to open-iscsi+unsubscr...@googlegroups.com.
> To post to this group, send email to open-iscsi@googlegroups.com.
> Visit this group at https://groups.google.com/group/open-iscsi.
> For more options, visit https://groups.google.com/d/optout.
--
You received this message because you are subscribed to the Google Groups
"open-iscsi" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to open-iscsi+unsubscr...@googlegroups.com.
To post to this group, send email to open-iscsi@googlegroups.com.
Visit this group at https://groups.google.com/group/open-iscsi.
For more options, visit https://groups.google.com/d/optout.
Re: [Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown
Chris, > Looks good to me, fixes up the code given that the comment there about > calling iscsi_remove_session wasn't being followed. Applied these two to 4.14/scsi-queue. -- Martin K. Petersen Oracle Linux Engineering -- You received this message because you are subscribed to the Google Groups "open-iscsi" group. To unsubscribe from this group and stop receiving emails from it, send an email to open-iscsi+unsubscr...@googlegroups.com. To post to this group, send email to open-iscsi@googlegroups.com. Visit this group at https://groups.google.com/group/open-iscsi. For more options, visit https://groups.google.com/d/optout.
