Re: [PATCH -next 2/2] scsi: iscsi: Fix use-after-free in iscsi_conn_release() for cleanup_work

[Mike Christie <michael.christie@oracle.com>]

On 8/21/26 4:24 AM, Ye Bin wrote:
> From: Ye Bin <yebin10@ huawei. com> iscsi_conn_error_event() queues conn- 
>  >cleanup_work without taking a reference to the connection. If the connection's 
> refcount drops to zero while the work is still pending or running, 
> iscsi_conn_release()
> 
> 
> From: Ye Bin <yebin10@huawei.com>
> 
> iscsi_conn_error_event() queues conn->cleanup_work without taking a
> reference to the connection. If the connection's refcount drops to zero
> while the work is still pending or running, iscsi_conn_release() frees
> the connection memory without canceling the work, leading to a
> use-after-free when iscsi_cleanup_conn_work_fn() later dereferences the
> freed conn struct.
> 
> This can happen when a session is torn down via iscsi_remove_session(),
> which calls iscsi_iter_destroy_conn_fn() to remove and drop the final
> reference on each remaining connection. Unlike iscsi_if_destroy_conn()
> (which flushes the work) and iscsi_if_stop_conn() (which cancels or
> flushes the work), the iscsi_iter_destroy_conn_fn() path does not handle
> the pending cleanup_work before dropping the connection reference.
> 
> Trigger flow:
> 
>    CPU 0 (error path)               CPU 1 (session teardown)
>    -----------------------          --------------------------
>    iscsi_conn_error_event(conn)
>      queue_work(cleanup_work)
>      [no conn reference taken]      iscsi_remove_session()
>                                       iscsi_iter_destroy_conn_fn()
>                                         iscsi_remove_conn(conn)
>                                         iscsi_put_conn(conn)
>                                           refcount == 0
>                                           iscsi_conn_release()
>                                             kfree(conn)
> 

It's not supported to run iscsi_remove_session while there's running
connections. That code was just meant for a qla4xxx mode where it
doesn't expose connections so the conn was just used to export info
to userspace via sysfs. It's for when the driver uses
qla4xxx_sess_conn_setup to create sessions and conns in one call.

There's not real use for it so I think fix qla4xxx to remove it's conn
firs, then check for session->leadconn != NULL in
libiscsi:iscsi_session_remove().
In scsi_transport_iscsi:iscsi_remove_session you could add a BUG then
since it should never be done.