• Bart Van Assche's avatar
    scsi: target: core: Release SPC-2 reservations when closing a session · 80647a89
    Bart Van Assche authored
    The SCSI specs require releasing SPC-2 reservations when a session is
    closed. Make sure that the target core does this.
    
    Running the libiscsi tests triggers the KASAN complaint shown below.  This
    patch fixes that use-after-free.
    
    BUG: KASAN: use-after-free in target_check_reservation+0x171/0x980 [target_core_mod]
    Read of size 8 at addr ffff88802ecd1878 by task iscsi_trx/17200
    
    CPU: 0 PID: 17200 Comm: iscsi_trx Not tainted 5.4.0-rc1-dbg+ #1
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    Call Trace:
     dump_stack+0x8a/0xd6
     print_address_description.constprop.0+0x40/0x60
     __kasan_report.cold+0x1b/0x34
     kasan_report+0x16/0x20
     __asan_load8+0x58/0x90
     target_check_reservation+0x171/0x980 [target_core_mod]
     __target_execute_cmd+0xb1/0xf0 [target_core_mod]
     target_execute_cmd+0x22d/0x4d0 [target_core_mod]
     transport_generic_new_cmd+0x31f/0x5b0 [target_core_mod]
     transport_handle_cdb_direct+0x6f/0x90 [target_core_mod]
     iscsit_execute_cmd+0x381/0x3f0 [iscsi_target_mod]
     iscsit_sequence_cmd+0x13b/0x1f0 [iscsi_target_mod]
     iscsit_process_scsi_cmd+0x4c/0x130 [iscsi_target_mod]
     iscsit_get_rx_pdu+0x8e8/0x15f0 [iscsi_target_mod]
     iscsi_target_rx_thread+0x105/0x1b0 [iscsi_target_mod]
     kthread+0x1bc/0x210
     ret_from_fork+0x24/0x30
    
    Allocated by task 1079:
     save_stack+0x23/0x90
     __kasan_kmalloc.constprop.0+0xcf/0xe0
     kasan_slab_alloc+0x12/0x20
     kmem_cache_alloc+0xfe/0x3a0
     transport_alloc_session+0x29/0x80 [target_core_mod]
     iscsi_target_login_thread+0xceb/0x1920 [iscsi_target_mod]
     kthread+0x1bc/0x210
     ret_from_fork+0x24/0x30
    
    Freed by task 17193:
     save_stack+0x23/0x90
     __kasan_slab_free+0x13a/0x190
     kasan_slab_free+0x12/0x20
     kmem_cache_free+0xc8/0x3e0
     transport_free_session+0x179/0x2f0 [target_core_mod]
     transport_deregister_session+0x121/0x170 [target_core_mod]
     iscsit_close_session+0x12c/0x350 [iscsi_target_mod]
     iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod]
     iscsit_response_queue+0x8fa/0xc00 [iscsi_target_mod]
     iscsi_target_tx_thread+0x28e/0x390 [iscsi_target_mod]
     kthread+0x1bc/0x210
     ret_from_fork+0x24/0x30
    
    The buggy address belongs to the object at ffff88802ecd1860
     which belongs to the cache se_sess_cache of size 352
    The buggy address is located 24 bytes inside of
     352-byte region [ffff88802ecd1860, ffff88802ecd19c0)
    The buggy address belongs to the page:
    page:ffffea0000bb3400 refcount:1 mapcount:0 mapping:ffff8880bef2ed00 index:0x0 compound_mapcount: 0
    flags: 0x1000000000010200(slab|head)
    raw: 1000000000010200 dead000000000100 dead000000000122 ffff8880bef2ed00
    raw: 0000000000000000 0000000080270027 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected
    
    Memory state around the buggy address:
     ffff88802ecd1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ffff88802ecd1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    >ffff88802ecd1800: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
                                                                    ^
     ffff88802ecd1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ffff88802ecd1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    
    Cc: Mike Christie <mchristi@redhat.com>
    Link: https://lore.kernel.org/r/20191113220508.198257-2-bvanassche@acm.org
    
    
    Reviewed-by: default avatarRoman Bolshakov <r.bolshakov@yadro.com>
    Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
    Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
    80647a89