scsi: target: tcmu: Fix possible page UAF
authorXiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
Fri, 11 Mar 2022 13:22:05 +0000 (21:22 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Apr 2022 07:34:15 +0000 (09:34 +0200)
commitb7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322
tree6d5d2885904e258ebd3898b0af36bf2d877ddc58
parent44f95a5aae99afff298491c057acae4d895c9bdd
scsi: target: tcmu: Fix possible page UAF

[ Upstream commit a6968f7a367f128d120447360734344d5a3d5336 ]

tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not
take refcount properly and just returns page pointer. When
tcmu_try_get_data_page() returns, the returned page may have been freed by
tcmu_blocks_release().

We need to get_page() under cmdr_lock to avoid concurrent
tcmu_blocks_release().

Link: https://lore.kernel.org/r/20220311132206.24515-1-xiaoguang.wang@linux.alibaba.com
Reviewed-by: Bodo Stroesser <bostroesser@gmail.com>
Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/target/target_core_user.c