From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Christie Date: Mon, 13 Aug 2018 19:48:03 +0000 Subject: Re: BUG in slab_free after iSCSI login timeout Message-Id: <5B71E073.5000105@redhat.com> List-Id: References: <20180811093655.42922d8e@gmail.com> In-Reply-To: <20180811093655.42922d8e@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: target-devel@vger.kernel.org On 08/11/2018 10:51 PM, Vincent Pelletier wrote: > On Sun, 12 Aug 2018 02:55:31 +0000, Vincent Pelletier > wrote: >> Aug 12 04:44:53 boke kernel: [ 64.737069] BUG: KASAN: use-after-free in iscsi_target_login_sess_out.cold.11+0x58/0x123 [iscsi_target_mod] >> Aug 12 04:44:53 boke kernel: [ 64.771148] BUG: KASAN: double-free or invalid-free in iscsi_target_login_sess_out.cold.11+0x103/0x123 [iscsi_target_mod] > > If I'm reading the code correctly, the double-free would be > iscsi_login_init_conn and iscsi_target_login_sess_out both calling > kfree(conn->conn_ops), with the latter called by > __iscsi_target_login_thread precisely when the former fails (returns > NULL after freeing). > I think I fixed that with this patch: https://www.spinics.net/lists/target-devel/msg17018.html It fixes a mix of problems double free of the ops, session and reference after free.