hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

scsi: libiscsi: Fix use-after-free race during iscsi_session_teardown 

Session attributes exposed through sysfs were freed before the device
was destroyed, resulting in a potential use-after-free. Free these
attributes after removing the device.

Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
Acked-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Khazhismel Kumykov 2017-07-13 09:11:21 -07:00 committed by Martin K. Petersen
parent 77082ca503
commit 9e10b5121a
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/scsi/libiscsi.c
View File

@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup);
/** /**
* iscsi_session_teardown - destroy session, host, and cls_session * iscsi_session_teardown - destroy session, host, and cls_session
* @cls_session: iscsi session * @cls_session: iscsi session
*
* The driver must have called iscsi_remove_session before
* calling this.
*/ */
void iscsi_session_teardown(struct iscsi_cls_session *cls_session) void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
{ {
@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
iscsi_pool_free(&session->cmdpool); iscsi_pool_free(&session->cmdpool);
iscsi_remove_session(cls_session);
kfree(session->password); kfree(session->password);
kfree(session->password_in); kfree(session->password_in);
kfree(session->username); kfree(session->username);
@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
kfree(session->portal_type); kfree(session->portal_type);
kfree(session->discovery_parent_type); kfree(session->discovery_parent_type);
iscsi_destroy_session(cls_session); iscsi_free_session(cls_session);
iscsi_host_dec_session_cnt(shost); iscsi_host_dec_session_cnt(shost);
module_put(owner); module_put(owner);
} }