[PATCH 0/2] Fix a use after free in target driver

[PATCH 0/2] Fix a use after free in target driver

[Maurizio Lombardi]

The following KASAN report has been reported
by Zhaojuan Guo <zguo@redhat.com>


==================================================================
 BUG: KASAN: slab-use-after-free in lock_release+0xd4/0x1e8
 Read of size 8 at addr ffff0000e9b2c778 by task targetctl/21319

 kasan_report+0x90/0xc8
 __asan_load8+0xb8/0xc0
 lock_release+0xd4/0x1e8
 rt_spin_unlock+0x2c/0xb8
 iscsit_dec_conn_usage_count+0x68/0xa0 [iscsi_target_mod]
 iscsit_stop_session+0x140/0x220 [iscsi_target_mod]
 iscsit_release_sessions_for_tpg+0x380/0x480 [iscsi_target_mod]
 iscsit_tpg_disable_portal_group+0x104/0x260 [iscsi_target_mod]
 lio_target_tiqn_enabletpg+0x3c/0x80 [iscsi_target_mod]
 target_tpg_disable+0x6c/0xb0 [target_core_mod]
 target_fabric_tpg_base_enable_store+0x110/0x128 [target_core_mod]
 configfs_write_iter+0x154/0x1d0
 new_sync_write+0x1c8/0x298
 vfs_write+0x2e8/0x348
 ksys_write+0xd8/0x198

 Allocated by task 20969:
  __kasan_kmalloc+0xb8/0xc0
  __kmalloc_cache_noprof+0x194/0x300
  iscsit_alloc_conn+0x48/0x4e0 [iscsi_target_mod]
  __iscsi_target_login_thread+0x108/0x960 [iscsi_target_mod]
  iscsi_target_login_thread+0x30/0x80 [iscsi_target_mod]
  kthread+0x190/0x1a8
  ret_from_fork+0x10/0x20

 Freed by task 21085:
  __kasan_slab_free+0x4c/0x70
  kfree+0x108/0x430
  iscsit_free_conn+0x74/0x90 [iscsi_target_mod]
  iscsit_close_connection+0x4ec/0xc98 [iscsi_target_mod]
  iscsit_take_action_for_connection_exit+0x114/0x270 [iscsi_target_mod]
  iscsi_target_tx_thread+0x268/0x340 [iscsi_target_mod]
  kthread+0x190/0x1a8
  ret_from_fork+0x10/0x20


I reproduced it by inserting a delay between the call to complete()
and the call to spin_unlock() inside the iscsit_dec_conn_usage_count().

iscsit_dec_session_usage_count() has the same problem.

Maurizio Lombardi (2):
  target: iscsi: fix use-after-free in iscsit_dec_conn_usage_count()
  target: iscsi: fix use-after-free in iscsit_dec_session_usage_count()

 drivers/target/iscsi/iscsi_target_util.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

-- 
2.47.3

[PATCH 1/2] scsi: target: iscsi: fix use-after-free in iscsit_dec_conn_usage_count()

[Maurizio Lombardi]

In iscsit_dec_conn_usage_count(), the function calls complete() while
holding the conn->conn_usage_lock. As soon as complete() is invoked,
the waiter (such as iscsit_close_connection) may wake up and proceed
to free the iscsit_conn structure.

If the waiter frees the memory before the current thread reaches
spin_unlock_bh(), it results in a KASAN slab-use-after-free as the
function attempts to release a lock within the already-freed
connection structure.

Fix this by releasing the spinlock before calling complete().

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reported-by: Zhaojuan Guo <zguo@redhat.com>
---
 drivers/target/iscsi/iscsi_target_util.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 5e6cf34929b5..3319394bf542 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -810,8 +810,11 @@ void iscsit_dec_conn_usage_count(struct iscsit_conn *conn)
 	spin_lock_bh(&conn->conn_usage_lock);
 	conn->conn_usage_count--;
 
-	if (!conn->conn_usage_count && conn->conn_waiting_on_uc)
+	if (!conn->conn_usage_count && conn->conn_waiting_on_uc) {
+		spin_unlock_bh(&conn->conn_usage_lock);
 		complete(&conn->conn_waiting_on_uc_comp);
+		return;
+	}
 
 	spin_unlock_bh(&conn->conn_usage_lock);
 }
-- 
2.47.3

Re: [PATCH 1/2] scsi: target: iscsi: fix use-after-free in iscsit_dec_conn_usage_count()

[Mike Christie]

On 1/12/26 10:53 AM, Maurizio Lombardi wrote:
> In iscsit_dec_conn_usage_count(), the function calls complete() while
> holding the conn->conn_usage_lock. As soon as complete() is invoked,
> the waiter (such as iscsit_close_connection) may wake up and proceed
> to free the iscsit_conn structure.
> 
> If the waiter frees the memory before the current thread reaches
> spin_unlock_bh(), it results in a KASAN slab-use-after-free as the
> function attempts to release a lock within the already-freed
> connection structure.
> 
> Fix this by releasing the spinlock before calling complete().
> 
> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
> Reported-by: Zhaojuan Guo <zguo@redhat.com>

Reviewed-by: Mike Christie <michael.christie@oracle.com>

[PATCH 2/2] scsi: target: iscsi: fix use-after-free in iscsit_dec_session_usage_count()

[Maurizio Lombardi]

In iscsit_dec_session_usage_count(), the function calls complete() while
holding the sess->session_usage_lock. Similar to the connection usage
count logic, the waiter signaled by complete() (e.g., in the session
release path) may wake up and free the iscsit_session
structure immediately.

This creates a race condition where the current thread may attempt to
execute spin_unlock_bh() on a session structure that has already been
deallocated, resulting in a KASAN slab-use-after-free.

To resolve this, release the session_usage_lock before calling complete()
to ensure all dereferences of the sess pointer are finished before the
waiter is allowed to proceed with deallocation.

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reported-by: Zhaojuan Guo <zguo@redhat.com>
---
 drivers/target/iscsi/iscsi_target_util.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 3319394bf542..c1888c42afdd 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -741,8 +741,11 @@ void iscsit_dec_session_usage_count(struct iscsit_session *sess)
 	spin_lock_bh(&sess->session_usage_lock);
 	sess->session_usage_count--;
 
-	if (!sess->session_usage_count && sess->session_waiting_on_uc)
+	if (!sess->session_usage_count && sess->session_waiting_on_uc) {
+		spin_unlock_bh(&sess->session_usage_lock);
 		complete(&sess->session_waiting_on_uc_comp);
+		return;
+	}
 
 	spin_unlock_bh(&sess->session_usage_lock);
 }
-- 
2.47.3

Re: [PATCH 2/2] scsi: target: iscsi: fix use-after-free in iscsit_dec_session_usage_count()

[Mike Christie]

On 1/12/26 10:53 AM, Maurizio Lombardi wrote:
> In iscsit_dec_session_usage_count(), the function calls complete() while
> holding the sess->session_usage_lock. Similar to the connection usage
> count logic, the waiter signaled by complete() (e.g., in the session
> release path) may wake up and free the iscsit_session
> structure immediately.
> 
> This creates a race condition where the current thread may attempt to
> execute spin_unlock_bh() on a session structure that has already been
> deallocated, resulting in a KASAN slab-use-after-free.
> 
> To resolve this, release the session_usage_lock before calling complete()
> to ensure all dereferences of the sess pointer are finished before the
> waiter is allowed to proceed with deallocation.
> 
> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
> Reported-by: Zhaojuan Guo <zguo@redhat.com>

Reviewed-by: Mike Christie <michael.christie@oracle.com>