[Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown

[Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown

[Khazhismel Kumykov]

[-- Attachment #1: Type: text/plain, Size: 1398 bytes --]

Session attributes exposed through sysfs were freed before the device
was destroyed, resulting in a potential use-after-free. Free these
attributes after removing the device.

Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
---
 drivers/scsi/libiscsi.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 42381adf0769..8696a51a5a0c 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup);
 /**
  * iscsi_session_teardown - destroy session, host, and cls_session
  * @cls_session: iscsi session
- *
- * The driver must have called iscsi_remove_session before
- * calling this.
  */
 void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 {
@@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 
 	iscsi_pool_free(&session->cmdpool);
 
+	iscsi_remove_session(cls_session);
+
 	kfree(session->password);
 	kfree(session->password_in);
 	kfree(session->username);
@@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 	kfree(session->portal_type);
 	kfree(session->discovery_parent_type);
 
-	iscsi_destroy_session(cls_session);
+	iscsi_free_session(cls_session);
+
 	iscsi_host_dec_session_cnt(shost);
 	module_put(owner);
 }
-- 
2.13.2.932.g7449e964c-goog


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4843 bytes --]

[Patch v2 2/2] libiscsi: Remove iscsi_destroy_session

[Khazhismel Kumykov]

[-- Attachment #1: Type: text/plain, Size: 1971 bytes --]

iscsi_session_teardown was the only user of this function. Function
currently is just short for iscsi_remove_session + iscsi_free_session.

Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
---
 drivers/scsi/scsi_transport_iscsi.c | 16 ----------------
 include/scsi/scsi_transport_iscsi.h |  1 -
 2 files changed, 17 deletions(-)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index a424eaeafeb0..924ac408d8a9 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2210,22 +2210,6 @@ void iscsi_free_session(struct iscsi_cls_session *session)
 }
 EXPORT_SYMBOL_GPL(iscsi_free_session);
 
-/**
- * iscsi_destroy_session - destroy iscsi session
- * @session: iscsi_session
- *
- * Can be called by a LLD or iscsi_transport. There must not be
- * any running connections.
- */
-int iscsi_destroy_session(struct iscsi_cls_session *session)
-{
-	iscsi_remove_session(session);
-	ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n");
-	iscsi_free_session(session);
-	return 0;
-}
-EXPORT_SYMBOL_GPL(iscsi_destroy_session);
-
 /**
  * iscsi_create_conn - create iscsi class connection
  * @session: iscsi cls session
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 6183d20a01fb..b266d2a3bcb1 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -434,7 +434,6 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost,
 						unsigned int target_id);
 extern void iscsi_remove_session(struct iscsi_cls_session *session);
 extern void iscsi_free_session(struct iscsi_cls_session *session);
-extern int iscsi_destroy_session(struct iscsi_cls_session *session);
 extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
 						int dd_size, uint32_t cid);
 extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
-- 
2.13.2.932.g7449e964c-goog


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4843 bytes --]

Re: [Patch v2 2/2] libiscsi: Remove iscsi_destroy_session

[Chris Leech]

Thanks.

Acked-by: Chris Leech <cleech@redhat.com>

On Thu, Jul 13, 2017 at 09:11:22AM -0700, 'Khazhismel Kumykov' via open-iscsi wrote:
> iscsi_session_teardown was the only user of this function. Function
> currently is just short for iscsi_remove_session + iscsi_free_session.
> 
> Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
> ---
>  drivers/scsi/scsi_transport_iscsi.c | 16 ----------------
>  include/scsi/scsi_transport_iscsi.h |  1 -
>  2 files changed, 17 deletions(-)
> 
> diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
> index a424eaeafeb0..924ac408d8a9 100644
> --- a/drivers/scsi/scsi_transport_iscsi.c
> +++ b/drivers/scsi/scsi_transport_iscsi.c
> @@ -2210,22 +2210,6 @@ void iscsi_free_session(struct iscsi_cls_session *session)
>  }
>  EXPORT_SYMBOL_GPL(iscsi_free_session);
>  
> -/**
> - * iscsi_destroy_session - destroy iscsi session
> - * @session: iscsi_session
> - *
> - * Can be called by a LLD or iscsi_transport. There must not be
> - * any running connections.
> - */
> -int iscsi_destroy_session(struct iscsi_cls_session *session)
> -{
> -	iscsi_remove_session(session);
> -	ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n");
> -	iscsi_free_session(session);
> -	return 0;
> -}
> -EXPORT_SYMBOL_GPL(iscsi_destroy_session);
> -
>  /**
>   * iscsi_create_conn - create iscsi class connection
>   * @session: iscsi cls session
> diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
> index 6183d20a01fb..b266d2a3bcb1 100644
> --- a/include/scsi/scsi_transport_iscsi.h
> +++ b/include/scsi/scsi_transport_iscsi.h
> @@ -434,7 +434,6 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost,
>  						unsigned int target_id);
>  extern void iscsi_remove_session(struct iscsi_cls_session *session);
>  extern void iscsi_free_session(struct iscsi_cls_session *session);
> -extern int iscsi_destroy_session(struct iscsi_cls_session *session);
>  extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
>  						int dd_size, uint32_t cid);
>  extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
> -- 
> 2.13.2.932.g7449e964c-goog
> 
> -- 
> You received this message because you are subscribed to the Google Groups "open-iscsi" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to open-iscsi+unsubscribe@googlegroups.com.
> To post to this group, send email to open-iscsi@googlegroups.com.
> Visit this group at https://groups.google.com/group/open-iscsi.
> For more options, visit https://groups.google.com/d/optout.

Re: [Patch v2 2/2] libiscsi: Remove iscsi_destroy_session

[Lee Duncan]

On 07/13/2017 09:11 AM, Khazhismel Kumykov wrote:
> iscsi_session_teardown was the only user of this function. Function
> currently is just short for iscsi_remove_session + iscsi_free_session.
> 
> Signed-off-by: Khazhismel Kumykov <khazhy@google.com>

Why is this needed? I dislike changes that don't fix anything.

> ---
>  drivers/scsi/scsi_transport_iscsi.c | 16 ----------------
>  include/scsi/scsi_transport_iscsi.h |  1 -
>  2 files changed, 17 deletions(-)
> 
> diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
> index a424eaeafeb0..924ac408d8a9 100644
> --- a/drivers/scsi/scsi_transport_iscsi.c
> +++ b/drivers/scsi/scsi_transport_iscsi.c
> @@ -2210,22 +2210,6 @@ void iscsi_free_session(struct iscsi_cls_session *session)
>  }
>  EXPORT_SYMBOL_GPL(iscsi_free_session);
>  
> -/**
> - * iscsi_destroy_session - destroy iscsi session
> - * @session: iscsi_session
> - *
> - * Can be called by a LLD or iscsi_transport. There must not be
> - * any running connections.
> - */
> -int iscsi_destroy_session(struct iscsi_cls_session *session)
> -{
> -	iscsi_remove_session(session);
> -	ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n");
> -	iscsi_free_session(session);
> -	return 0;
> -}
> -EXPORT_SYMBOL_GPL(iscsi_destroy_session);
> -
>  /**
>   * iscsi_create_conn - create iscsi class connection
>   * @session: iscsi cls session
> diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
> index 6183d20a01fb..b266d2a3bcb1 100644
> --- a/include/scsi/scsi_transport_iscsi.h
> +++ b/include/scsi/scsi_transport_iscsi.h
> @@ -434,7 +434,6 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost,
>  						unsigned int target_id);
>  extern void iscsi_remove_session(struct iscsi_cls_session *session);
>  extern void iscsi_free_session(struct iscsi_cls_session *session);
> -extern int iscsi_destroy_session(struct iscsi_cls_session *session);
>  extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
>  						int dd_size, uint32_t cid);
>  extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
> 

-- 
Lee Duncan
SUSE Labs

Re: [Patch v2 2/2] libiscsi: Remove iscsi_destroy_session

[Johannes Thumshirn]

On Wed, Sep 13, 2017 at 05:09:03PM -0700, Lee Duncan wrote:
> On 07/13/2017 09:11 AM, Khazhismel Kumykov wrote:
> > iscsi_session_teardown was the only user of this function. Function
> > currently is just short for iscsi_remove_session + iscsi_free_session.
> > 
> > Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
> 
> Why is this needed? I dislike changes that don't fix anything.

The function has no more users left after patch 1, so why keep it bitrotting?

-- 
Johannes Thumshirn                                          Storage
jthumshirn@suse.de                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850

Re: [Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown

[Khazhismel Kumykov]

[-- Attachment #1: Type: text/plain, Size: 108 bytes --]

On Thu, Jul 13, 2017 at 9:11 AM, Khazhismel Kumykov <khazhy@google.com> wrote:
Ping in case this was missed

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4843 bytes --]

Re: [Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown

[Chris Leech]

Looks good to me, fixes up the code given that the comment there about
calling iscsi_remove_session wasn't being followed.

Thanks

Acked-by: Chris Leech <cleech@redhat.com>

On Thu, Jul 13, 2017 at 09:11:21AM -0700, 'Khazhismel Kumykov' via open-iscsi wrote:
> Session attributes exposed through sysfs were freed before the device
> was destroyed, resulting in a potential use-after-free. Free these
> attributes after removing the device.
> 
> Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
> ---
>  drivers/scsi/libiscsi.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
> index 42381adf0769..8696a51a5a0c 100644
> --- a/drivers/scsi/libiscsi.c
> +++ b/drivers/scsi/libiscsi.c
> @@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup);
>  /**
>   * iscsi_session_teardown - destroy session, host, and cls_session
>   * @cls_session: iscsi session
> - *
> - * The driver must have called iscsi_remove_session before
> - * calling this.
>   */
>  void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
>  {
> @@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
>  
>  	iscsi_pool_free(&session->cmdpool);
>  
> +	iscsi_remove_session(cls_session);
> +
>  	kfree(session->password);
>  	kfree(session->password_in);
>  	kfree(session->username);
> @@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
>  	kfree(session->portal_type);
>  	kfree(session->discovery_parent_type);
>  
> -	iscsi_destroy_session(cls_session);
> +	iscsi_free_session(cls_session);
> +
>  	iscsi_host_dec_session_cnt(shost);
>  	module_put(owner);
>  }
> -- 
> 2.13.2.932.g7449e964c-goog
> 
> -- 
> You received this message because you are subscribed to the Google Groups "open-iscsi" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to open-iscsi+unsubscribe@googlegroups.com.
> To post to this group, send email to open-iscsi@googlegroups.com.
> Visit this group at https://groups.google.com/group/open-iscsi.
> For more options, visit https://groups.google.com/d/optout.

Re: [Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown

[Martin K. Petersen]

Chris,

> Looks good to me, fixes up the code given that the comment there about
> calling iscsi_remove_session wasn't being followed.

Applied these two to 4.14/scsi-queue.

-- 
Martin K. Petersen	Oracle Linux Engineering

Re: [Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown

[Khazhismel Kumykov]

[-- Attachment #1: Type: text/plain, Size: 381 bytes --]

Noticed these don't seem to be in 4.14/scsi-queue

On Tue, Aug 29, 2017 at 6:45 PM, Martin K. Petersen
<martin.petersen@oracle.com> wrote:
>
> Chris,
>
>> Looks good to me, fixes up the code given that the comment there about
>> calling iscsi_remove_session wasn't being followed.
>
> Applied these two to 4.14/scsi-queue.
>
> --
> Martin K. Petersen      Oracle Linux Engineering

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4843 bytes --]

Re: [Patch v2 1/2] libiscsi: Fix use-after-free race during iscsi_session_teardown

[Martin K. Petersen]

Khazhismel,

> Noticed these don't seem to be in 4.14/scsi-queue

Not sure what happened there. I apologize.

They are now in 4.14/scsi-fixes.

-- 
Martin K. Petersen	Oracle Linux Engineering