Re: [PATCH] scsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername

[Li Jinlin <lijinlin3@xxxxxxxxxx>]

On 2022/8/8 0:58, Mike Christie wrote:

> @@ -763,8 +768,15 @@ static int iscsi_sw_tcp_conn_set_param(struct iscsi_cls_conn *cls_conn,
>  		break;
>  	case ISCSI_PARAM_DATADGST_EN:
>  		iscsi_set_param(cls_conn, param, buf, buflen);
> +
> +		mutex_lock(&tcp_sw_conn->sock_lock);
> +		if (!tcp_sw_conn->sock) {
> +			mutex_unlock(&tcp_sw_conn->sock_lock);
> +			return -ENOTCONN;
> +		}
>  		tcp_sw_conn->sendpage = conn->datadgst_en ?
>  			sock_no_sendpage : tcp_sw_conn->sock->ops->sendpage;
> +		mutex_unlock(&tcp_sw_conn->sock_lock);
>  		break;
>  	case ISCSI_PARAM_MAX_R2T:
>  		return iscsi_tcp_set_max_r2t(conn, buf);
> @@ -789,14 +801,12 @@ static int iscsi_sw_tcp_conn_get_param(struct iscsi_cls_conn *cls_conn,
>  	case ISCSI_PARAM_CONN_PORT:
>  	case ISCSI_PARAM_CONN_ADDRESS:
>  	case ISCSI_PARAM_LOCAL_PORT:
> -		spin_lock_bh(&conn->session->frwd_lock);
> -		if (!tcp_sw_conn || !tcp_sw_conn->sock) {
> -			spin_unlock_bh(&conn->session->frwd_lock);
> +		mutex_lock(&tcp_sw_conn->sock_lock);

In iscsi_tcp_conn_setup(), cls_conn was setup before initializing
tcp_sw_conn. So tcp_sw_conn may be NULL in here, need to add a check.

Thanks,
JinLin

> +		sock = tcp_sw_conn->sock;
> +		if (!sock) {
> +			mutex_unlock(&tcp_sw_conn->sock_lock);
>  			return -ENOTCONN;
>  		}
> -		sock = tcp_sw_conn->sock;
> -		sock_hold(sock->sk);
> -		spin_unlock_bh(&conn->session->frwd_lock);
>  
>  		if (param == ISCSI_PARAM_LOCAL_PORT)
>  			rc = kernel_getsockname(sock,