diff mbox series

[2/2] target/iscsi: Fix a use-after-free while closing a session

Message ID 20191111182944.191123-3-bvanassche@acm.org (mailing list archive)
State Changes Requested
Headers show
Series Improve SPC-2 reservation support | expand

Commit Message

Bart Van Assche Nov. 11, 2019, 6:29 p.m. UTC
This patch fixes the following use-after-free in the code that supports
SPC-2 reservations:

BUG: KASAN: use-after-free in target_check_reservation+0x171/0x980 [target_core_mod]
Read of size 8 at addr ffff88802ecd1878 by task iscsi_trx/17200

CPU: 0 PID: 17200 Comm: iscsi_trx Not tainted 5.4.0-rc1-dbg+ #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
 dump_stack+0x8a/0xd6
 print_address_description.constprop.0+0x40/0x60
 __kasan_report.cold+0x1b/0x34
 kasan_report+0x16/0x20
 __asan_load8+0x58/0x90
 target_check_reservation+0x171/0x980 [target_core_mod]
 __target_execute_cmd+0xb1/0xf0 [target_core_mod]
 target_execute_cmd+0x22d/0x4d0 [target_core_mod]
 transport_generic_new_cmd+0x31f/0x5b0 [target_core_mod]
 transport_handle_cdb_direct+0x6f/0x90 [target_core_mod]
 iscsit_execute_cmd+0x381/0x3f0 [iscsi_target_mod]
 iscsit_sequence_cmd+0x13b/0x1f0 [iscsi_target_mod]
 iscsit_process_scsi_cmd+0x4c/0x130 [iscsi_target_mod]
 iscsit_get_rx_pdu+0x8e8/0x15f0 [iscsi_target_mod]
 iscsi_target_rx_thread+0x105/0x1b0 [iscsi_target_mod]
 kthread+0x1bc/0x210
 ret_from_fork+0x24/0x30

Allocated by task 1079:
 save_stack+0x23/0x90
 __kasan_kmalloc.constprop.0+0xcf/0xe0
 kasan_slab_alloc+0x12/0x20
 kmem_cache_alloc+0xfe/0x3a0
 transport_alloc_session+0x29/0x80 [target_core_mod]
 iscsi_target_login_thread+0xceb/0x1920 [iscsi_target_mod]
 kthread+0x1bc/0x210
 ret_from_fork+0x24/0x30

Freed by task 17193:
 save_stack+0x23/0x90
 __kasan_slab_free+0x13a/0x190
 kasan_slab_free+0x12/0x20
 kmem_cache_free+0xc8/0x3e0
 transport_free_session+0x179/0x2f0 [target_core_mod]
 transport_deregister_session+0x121/0x170 [target_core_mod]
 iscsit_close_session+0x12c/0x350 [iscsi_target_mod]
 iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod]
 iscsit_response_queue+0x8fa/0xc00 [iscsi_target_mod]
 iscsi_target_tx_thread+0x28e/0x390 [iscsi_target_mod]
 kthread+0x1bc/0x210
 ret_from_fork+0x24/0x30

The buggy address belongs to the object at ffff88802ecd1860
 which belongs to the cache se_sess_cache of size 352
The buggy address is located 24 bytes inside of
 352-byte region [ffff88802ecd1860, ffff88802ecd19c0)
The buggy address belongs to the page:
page:ffffea0000bb3400 refcount:1 mapcount:0 mapping:ffff8880bef2ed00 index:0x0 compound_mapcount: 0
flags: 0x1000000000010200(slab|head)
raw: 1000000000010200 dead000000000100 dead000000000122 ffff8880bef2ed00
raw: 0000000000000000 0000000080270027 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88802ecd1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802ecd1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802ecd1800: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
                                                                ^
 ffff88802ecd1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802ecd1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Cc: Mike Christie <mchristi@redhat.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/target/target_core_transport.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

Comments

Roman Bolshakov Nov. 11, 2019, 7:41 p.m. UTC | #1
On Mon, Nov 11, 2019 at 10:29:44AM -0800, Bart Van Assche wrote:
> This patch fixes the following use-after-free in the code that supports
> SPC-2 reservations:
> 
> BUG: KASAN: use-after-free in target_check_reservation+0x171/0x980 [target_core_mod]
> Read of size 8 at addr ffff88802ecd1878 by task iscsi_trx/17200
> 
> CPU: 0 PID: 17200 Comm: iscsi_trx Not tainted 5.4.0-rc1-dbg+ #1
> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> Call Trace:
>  dump_stack+0x8a/0xd6
>  print_address_description.constprop.0+0x40/0x60
>  __kasan_report.cold+0x1b/0x34
>  kasan_report+0x16/0x20
>  __asan_load8+0x58/0x90
>  target_check_reservation+0x171/0x980 [target_core_mod]
>  __target_execute_cmd+0xb1/0xf0 [target_core_mod]
>  target_execute_cmd+0x22d/0x4d0 [target_core_mod]
>  transport_generic_new_cmd+0x31f/0x5b0 [target_core_mod]
>  transport_handle_cdb_direct+0x6f/0x90 [target_core_mod]
>  iscsit_execute_cmd+0x381/0x3f0 [iscsi_target_mod]
>  iscsit_sequence_cmd+0x13b/0x1f0 [iscsi_target_mod]
>  iscsit_process_scsi_cmd+0x4c/0x130 [iscsi_target_mod]
>  iscsit_get_rx_pdu+0x8e8/0x15f0 [iscsi_target_mod]
>  iscsi_target_rx_thread+0x105/0x1b0 [iscsi_target_mod]
>  kthread+0x1bc/0x210
>  ret_from_fork+0x24/0x30
> 
> Allocated by task 1079:
>  save_stack+0x23/0x90
>  __kasan_kmalloc.constprop.0+0xcf/0xe0
>  kasan_slab_alloc+0x12/0x20
>  kmem_cache_alloc+0xfe/0x3a0
>  transport_alloc_session+0x29/0x80 [target_core_mod]
>  iscsi_target_login_thread+0xceb/0x1920 [iscsi_target_mod]
>  kthread+0x1bc/0x210
>  ret_from_fork+0x24/0x30
> 
> Freed by task 17193:
>  save_stack+0x23/0x90
>  __kasan_slab_free+0x13a/0x190
>  kasan_slab_free+0x12/0x20
>  kmem_cache_free+0xc8/0x3e0
>  transport_free_session+0x179/0x2f0 [target_core_mod]
>  transport_deregister_session+0x121/0x170 [target_core_mod]
>  iscsit_close_session+0x12c/0x350 [iscsi_target_mod]
>  iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod]
>  iscsit_response_queue+0x8fa/0xc00 [iscsi_target_mod]
>  iscsi_target_tx_thread+0x28e/0x390 [iscsi_target_mod]
>  kthread+0x1bc/0x210
>  ret_from_fork+0x24/0x30
> 
> The buggy address belongs to the object at ffff88802ecd1860
>  which belongs to the cache se_sess_cache of size 352
> The buggy address is located 24 bytes inside of
>  352-byte region [ffff88802ecd1860, ffff88802ecd19c0)
> The buggy address belongs to the page:
> page:ffffea0000bb3400 refcount:1 mapcount:0 mapping:ffff8880bef2ed00 index:0x0 compound_mapcount: 0
> flags: 0x1000000000010200(slab|head)
> raw: 1000000000010200 dead000000000100 dead000000000122 ffff8880bef2ed00
> raw: 0000000000000000 0000000080270027 00000001ffffffff 0000000000000000
> page dumped because: kasan: bad access detected
> 
> Memory state around the buggy address:
>  ffff88802ecd1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>  ffff88802ecd1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >ffff88802ecd1800: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
>                                                                 ^
>  ffff88802ecd1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>  ffff88802ecd1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> 
> Cc: Mike Christie <mchristi@redhat.com>
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/target/target_core_transport.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index ba7a01bcad7c..12bc8545f91b 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -584,6 +584,15 @@ void transport_free_session(struct se_session *se_sess)
>  }
>  EXPORT_SYMBOL(transport_free_session);
>  
> +static int target_release_res(struct se_device *dev, void *data)
> +{
> +	struct se_session *sess = data;
> +
> +	if (dev->reservation_holder == sess)
> +		dev->reservation_holder = NULL;


Hi Bart,

Does it worth to use target_release_reservation() when the session is
reserveration holder instead of the explicit assignment? That would also
reset reservation flags of the se_device.

> +	return 0;
> +}
> +
>  void transport_deregister_session(struct se_session *se_sess)
>  {
>  	struct se_portal_group *se_tpg = se_sess->se_tpg;
> @@ -600,6 +609,8 @@ void transport_deregister_session(struct se_session *se_sess)
>  	se_sess->fabric_sess_ptr = NULL;
>  	spin_unlock_irqrestore(&se_tpg->session_lock, flags);
>  
> +	target_for_each_device(target_release_res, se_sess);
> +
>  	pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
>  		se_tpg->se_tpg_tfo->fabric_name);
>  	/*
> -- 
> 2.24.0.rc1.363.gb1bccd3e3d-goog
> 

IMO the code is not specific to iscsi and the tag should be changed to
"target/core:"


Thanks,
Roman
Bart Van Assche Nov. 11, 2019, 8:23 p.m. UTC | #2
On 11/11/19 11:41 AM, Roman Bolshakov wrote:
> On Mon, Nov 11, 2019 at 10:29:44AM -0800, Bart Van Assche wrote:
>> +static int target_release_res(struct se_device *dev, void *data)
>> +{
>> +	struct se_session *sess = data;
>> +
>> +	if (dev->reservation_holder == sess)
>> +		dev->reservation_holder = NULL;
> 
> Does it worth to use target_release_reservation() when the session is
> reserveration holder instead of the explicit assignment? That would also
> reset reservation flags of the se_device.

That sounds like a good idea to me. I will look into this.

> IMO the code is not specific to iscsi and the tag should be changed to
> "target/core:"

Agreed. I will fix the patch subject.

Bart.
diff mbox series

Patch

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index ba7a01bcad7c..12bc8545f91b 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -584,6 +584,15 @@  void transport_free_session(struct se_session *se_sess)
 }
 EXPORT_SYMBOL(transport_free_session);
 
+static int target_release_res(struct se_device *dev, void *data)
+{
+	struct se_session *sess = data;
+
+	if (dev->reservation_holder == sess)
+		dev->reservation_holder = NULL;
+	return 0;
+}
+
 void transport_deregister_session(struct se_session *se_sess)
 {
 	struct se_portal_group *se_tpg = se_sess->se_tpg;
@@ -600,6 +609,8 @@  void transport_deregister_session(struct se_session *se_sess)
 	se_sess->fabric_sess_ptr = NULL;
 	spin_unlock_irqrestore(&se_tpg->session_lock, flags);
 
+	target_for_each_device(target_release_res, se_sess);
+
 	pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
 		se_tpg->se_tpg_tfo->fabric_name);
 	/*