Linux SCSI subsystem development
 help / color / mirror / Atom feed
From: Maurizio Lombardi <mlombard@redhat.com>
To: martin.petersen@oracle.com
Cc: mlombard@bsdbackstore.eu, linux-scsi@vger.kernel.org,
	target-devel@vger.kernel.org, michael.christie@oracle.com
Subject: [PATCH 0/2] Fix a use after free in target driver
Date: Mon, 12 Jan 2026 17:53:50 +0100	[thread overview]
Message-ID: <20260112165352.138606-1-mlombard@redhat.com> (raw)

The following KASAN report has been reported
by Zhaojuan Guo <zguo@redhat.com>


==================================================================
 BUG: KASAN: slab-use-after-free in lock_release+0xd4/0x1e8
 Read of size 8 at addr ffff0000e9b2c778 by task targetctl/21319

 kasan_report+0x90/0xc8
 __asan_load8+0xb8/0xc0
 lock_release+0xd4/0x1e8
 rt_spin_unlock+0x2c/0xb8
 iscsit_dec_conn_usage_count+0x68/0xa0 [iscsi_target_mod]
 iscsit_stop_session+0x140/0x220 [iscsi_target_mod]
 iscsit_release_sessions_for_tpg+0x380/0x480 [iscsi_target_mod]
 iscsit_tpg_disable_portal_group+0x104/0x260 [iscsi_target_mod]
 lio_target_tiqn_enabletpg+0x3c/0x80 [iscsi_target_mod]
 target_tpg_disable+0x6c/0xb0 [target_core_mod]
 target_fabric_tpg_base_enable_store+0x110/0x128 [target_core_mod]
 configfs_write_iter+0x154/0x1d0
 new_sync_write+0x1c8/0x298
 vfs_write+0x2e8/0x348
 ksys_write+0xd8/0x198

 Allocated by task 20969:
  __kasan_kmalloc+0xb8/0xc0
  __kmalloc_cache_noprof+0x194/0x300
  iscsit_alloc_conn+0x48/0x4e0 [iscsi_target_mod]
  __iscsi_target_login_thread+0x108/0x960 [iscsi_target_mod]
  iscsi_target_login_thread+0x30/0x80 [iscsi_target_mod]
  kthread+0x190/0x1a8
  ret_from_fork+0x10/0x20

 Freed by task 21085:
  __kasan_slab_free+0x4c/0x70
  kfree+0x108/0x430
  iscsit_free_conn+0x74/0x90 [iscsi_target_mod]
  iscsit_close_connection+0x4ec/0xc98 [iscsi_target_mod]
  iscsit_take_action_for_connection_exit+0x114/0x270 [iscsi_target_mod]
  iscsi_target_tx_thread+0x268/0x340 [iscsi_target_mod]
  kthread+0x190/0x1a8
  ret_from_fork+0x10/0x20


I reproduced it by inserting a delay between the call to complete()
and the call to spin_unlock() inside the iscsit_dec_conn_usage_count().

iscsit_dec_session_usage_count() has the same problem.

Maurizio Lombardi (2):
  target: iscsi: fix use-after-free in iscsit_dec_conn_usage_count()
  target: iscsi: fix use-after-free in iscsit_dec_session_usage_count()

 drivers/target/iscsi/iscsi_target_util.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

-- 
2.47.3


             reply	other threads:[~2026-01-12 16:54 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-01-12 16:53 Maurizio Lombardi [this message]
2026-01-12 16:53 ` [PATCH 1/2] scsi: target: iscsi: fix use-after-free in iscsit_dec_conn_usage_count() Maurizio Lombardi
2026-01-12 18:56   ` Mike Christie
2026-01-12 16:53 ` [PATCH 2/2] scsi: target: iscsi: fix use-after-free in iscsit_dec_session_usage_count() Maurizio Lombardi
2026-01-12 18:56   ` Mike Christie

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260112165352.138606-1-mlombard@redhat.com \
    --to=mlombard@redhat.com \
    --cc=linux-scsi@vger.kernel.org \
    --cc=martin.petersen@oracle.com \
    --cc=michael.christie@oracle.com \
    --cc=mlombard@bsdbackstore.eu \
    --cc=target-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox