Maurizio Lombardi 3ecdca49ca scsi: target: iscsi: Fix a race condition between login_work and the login thread ... [ Upstream commit fec1b2fa62 ] In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_ready() callback will schedule the login_work and, at the same time, the negotiation may end without clearing the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are required to complete the login). The login has been completed but the login_work function will find the LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling itself; at this point, if the initiator drops the connection, the iscsit_conn structure will be freed, login_work will dereference a released socket structure and the kernel crashes. BUG: kernel NULL pointer dereference, address: 0000000000000230 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod] RIP: 0010:_raw_read_lock_bh+0x15/0x30 Call trace: iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod] process_one_work+0x1e8/0x3c0 Fix this bug by forcing login_work to stop after the login has been completed and the socket callbacks have been restored. Add a comment to clearify the return values of iscsi_target_do_login() Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Link: https://lore.kernel.org/r/20221115125638.102517-1-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-12-31 13:33:06 +01:00
..
iscsi	scsi: target: iscsi: Fix a race condition between login_work and the login thread	2022-12-31 13:33:06 +01:00
loopback	scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()	2022-11-17 17:46:16 +00:00
sbp	…
tcm_fc	…
Kconfig	…
Makefile	…
target_core_alua.c	scsi: target: alua: Do not report emtpy port group	2022-09-15 21:42:44 -04:00
target_core_alua.h	…
target_core_configfs.c	…
target_core_device.c	scsi: target: core: UA on all LUNs after reset	2022-10-01 05:06:53 -04:00
target_core_fabric_configfs.c	…
target_core_fabric_lib.c	…
target_core_file.c	…
target_core_file.h	…
target_core_hba.c	…
target_core_iblock.c	scsi: target: iblock: Fold iblock_emulate_read_cap_with_block_size() into iblock_get_blocks()	2022-10-01 05:51:47 -04:00
target_core_iblock.h	…
target_core_internal.h	scsi: target: core: UA on all LUNs after reset	2022-10-01 05:06:53 -04:00
target_core_pr.c	scsi: target: core: New key must be used for moved PR	2022-10-01 05:03:57 -04:00
target_core_pr.h	…
target_core_pscsi.c	SCSI misc on 20221007	2022-10-07 12:33:18 -07:00
target_core_pscsi.h	…
target_core_rd.c	…
target_core_rd.h	…
target_core_sbc.c	…
target_core_spc.c	scsi: target: core: Set MULTIP bit for se_device with multiple ports	2022-09-15 21:40:58 -04:00
target_core_stat.c	…
target_core_tmr.c	…
target_core_tpg.c	…
target_core_transport.c	scsi: target: core: UA on all LUNs after reset	2022-10-01 05:06:53 -04:00
target_core_ua.c	…
target_core_ua.h	…
target_core_user.c	…
target_core_xcopy.c	…
target_core_xcopy.h	…