From: Maurizio Lombardi <mlombard@redhat.com>
To: martin.petersen@oracle.com
Cc: mlombard@bsdbackstore.eu, linux-scsi@vger.kernel.org,
target-devel@vger.kernel.org, michael.christie@oracle.com
Subject: [PATCH 0/2] Fix a use after free in target driver
Date: Mon, 12 Jan 2026 17:53:50 +0100 [thread overview]
Message-ID: <20260112165352.138606-1-mlombard@redhat.com> (raw)
The following KASAN report has been reported
by Zhaojuan Guo <zguo@redhat.com>
==================================================================
BUG: KASAN: slab-use-after-free in lock_release+0xd4/0x1e8
Read of size 8 at addr ffff0000e9b2c778 by task targetctl/21319
kasan_report+0x90/0xc8
__asan_load8+0xb8/0xc0
lock_release+0xd4/0x1e8
rt_spin_unlock+0x2c/0xb8
iscsit_dec_conn_usage_count+0x68/0xa0 [iscsi_target_mod]
iscsit_stop_session+0x140/0x220 [iscsi_target_mod]
iscsit_release_sessions_for_tpg+0x380/0x480 [iscsi_target_mod]
iscsit_tpg_disable_portal_group+0x104/0x260 [iscsi_target_mod]
lio_target_tiqn_enabletpg+0x3c/0x80 [iscsi_target_mod]
target_tpg_disable+0x6c/0xb0 [target_core_mod]
target_fabric_tpg_base_enable_store+0x110/0x128 [target_core_mod]
configfs_write_iter+0x154/0x1d0
new_sync_write+0x1c8/0x298
vfs_write+0x2e8/0x348
ksys_write+0xd8/0x198
Allocated by task 20969:
__kasan_kmalloc+0xb8/0xc0
__kmalloc_cache_noprof+0x194/0x300
iscsit_alloc_conn+0x48/0x4e0 [iscsi_target_mod]
__iscsi_target_login_thread+0x108/0x960 [iscsi_target_mod]
iscsi_target_login_thread+0x30/0x80 [iscsi_target_mod]
kthread+0x190/0x1a8
ret_from_fork+0x10/0x20
Freed by task 21085:
__kasan_slab_free+0x4c/0x70
kfree+0x108/0x430
iscsit_free_conn+0x74/0x90 [iscsi_target_mod]
iscsit_close_connection+0x4ec/0xc98 [iscsi_target_mod]
iscsit_take_action_for_connection_exit+0x114/0x270 [iscsi_target_mod]
iscsi_target_tx_thread+0x268/0x340 [iscsi_target_mod]
kthread+0x190/0x1a8
ret_from_fork+0x10/0x20
I reproduced it by inserting a delay between the call to complete()
and the call to spin_unlock() inside the iscsit_dec_conn_usage_count().
iscsit_dec_session_usage_count() has the same problem.
Maurizio Lombardi (2):
target: iscsi: fix use-after-free in iscsit_dec_conn_usage_count()
target: iscsi: fix use-after-free in iscsit_dec_session_usage_count()
drivers/target/iscsi/iscsi_target_util.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--
2.47.3
next reply other threads:[~2026-01-12 16:54 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-12 16:53 Maurizio Lombardi [this message]
2026-01-12 16:53 ` [PATCH 1/2] scsi: target: iscsi: fix use-after-free in iscsit_dec_conn_usage_count() Maurizio Lombardi
2026-01-12 18:56 ` Mike Christie
2026-01-12 16:53 ` [PATCH 2/2] scsi: target: iscsi: fix use-after-free in iscsit_dec_session_usage_count() Maurizio Lombardi
2026-01-12 18:56 ` Mike Christie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260112165352.138606-1-mlombard@redhat.com \
--to=mlombard@redhat.com \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=michael.christie@oracle.com \
--cc=mlombard@bsdbackstore.eu \
--cc=target-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox