Patch "scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     scsi-libiscsi-fix-uaf-in-iscsi_conn_get_param-iscsi_.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 72131bd43c4a6162a414c5504e6bc01366b0ce64
Author: Lixiaokeng <lixiaokeng@xxxxxxxxxx>
Date:   Mon Dec 20 19:39:06 2021 +0800

    scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
    
    [ Upstream commit 1b8d0300a3e9f216ae4901bab886db7299899ec6 ]
    
    |- iscsi_if_destroy_conn            |-dev_attr_show
     |-iscsi_conn_teardown
      |-spin_lock_bh                     |-iscsi_sw_tcp_conn_get_param
    
      |-kfree(conn->persistent_address)   |-iscsi_conn_get_param
      |-kfree(conn->local_ipaddr)
                                           ==>|-read persistent_address
                                           ==>|-read local_ipaddr
      |-spin_unlock_bh
    
    When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a
    UAF may be triggered.
    
    Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@xxxxxxxxxx
    Reported-by: Lu Tixiong <lutianxiong@xxxxxxxxxx>
    Reviewed-by: Mike Christie <michael.christie@xxxxxxxxxx>
    Reviewed-by: Lee Duncan <lduncan@xxxxxxxx>
    Signed-off-by: Lixiaokeng <lixiaokeng@xxxxxxxxxx>
    Signed-off-by: Linfeilong <linfeilong@xxxxxxxxxx>
    Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 5bc91d34df634..cbc263ec9d661 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -3101,6 +3101,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
 {
 	struct iscsi_conn *conn = cls_conn->dd_data;
 	struct iscsi_session *session = conn->session;
+	char *tmp_persistent_address = conn->persistent_address;
+	char *tmp_local_ipaddr = conn->local_ipaddr;
 
 	del_timer_sync(&conn->transport_timer);
 
@@ -3122,8 +3124,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
 	spin_lock_bh(&session->frwd_lock);
 	free_pages((unsigned long) conn->data,
 		   get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
-	kfree(conn->persistent_address);
-	kfree(conn->local_ipaddr);
 	/* regular RX path uses back_lock */
 	spin_lock_bh(&session->back_lock);
 	kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
@@ -3135,6 +3135,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
 	mutex_unlock(&session->eh_mutex);
 
 	iscsi_destroy_conn(cls_conn);
+	kfree(tmp_persistent_address);
+	kfree(tmp_local_ipaddr);
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_teardown);