iscsi-target: Fix use-after-free during TPG session shutdown
authorNicholas Bellinger <nab@linux-iscsi.org>
Wed, 22 Jul 2015 07:24:09 +0000 (00:24 -0700)
committerNicholas Bellinger <nab@linux-iscsi.org>
Fri, 24 Jul 2015 21:19:43 +0000 (14:19 -0700)
commit417c20a9bdd1e876384127cf096d8ae8b559066c
treedc8c04ab25bf7d0d987f3fdb228fd361ed8e2364
parent7359df25a53386dd33c223672bbd12cb49d0ce4f
iscsi-target: Fix use-after-free during TPG session shutdown

This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
where se_portal_group->session_lock was incorrectly released/re-acquired
while walking the active se_portal_group->tpg_sess_list.

The can result in a NULL pointer dereference when iscsit_close_session()
shutdown happens in the normal path asynchronously to this code, causing
a bogus dereference of an already freed list entry to occur.

To address this bug, walk the session list checking for the same state
as before, but move entries to a local list to avoid dropping the lock
while walking the active list.

As before, signal using iscsi_session->session_restatement=1 for those
list entries to be released locally by iscsit_free_session() code.

Reported-by: Sunilkumar Nadumuttlu <sjn@datera.io>
Cc: Sunilkumar Nadumuttlu <sjn@datera.io>
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
drivers/target/iscsi/iscsi_target.c