diff options
| author | Khazhismel Kumykov <khazhy@google.com> | 2017-07-13 18:11:21 +0200 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2017-10-03 04:23:21 +0200 |
| commit | 9e10b5121ad991ea6e84ca40b15a04cdc551bfe9 (patch) | |
| tree | 46ec66e479d194da6637be04d20d8ea9d243a8c5 /drivers/scsi | |
| parent | scsi: sd: Do not override max_sectors_kb sysfs setting (diff) | |
| download | linux-9e10b5121ad991ea6e84ca40b15a04cdc551bfe9.tar.xz linux-9e10b5121ad991ea6e84ca40b15a04cdc551bfe9.zip | |
scsi: libiscsi: Fix use-after-free race during iscsi_session_teardown
Session attributes exposed through sysfs were freed before the device
was destroyed, resulting in a potential use-after-free. Free these
attributes after removing the device.
Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
Acked-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi')
| -rw-r--r-- | drivers/scsi/libiscsi.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index bd4605a34f54..c62e8d111fd9 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup); /** * iscsi_session_teardown - destroy session, host, and cls_session * @cls_session: iscsi session - * - * The driver must have called iscsi_remove_session before - * calling this. */ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) { @@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) iscsi_pool_free(&session->cmdpool); + iscsi_remove_session(cls_session); + kfree(session->password); kfree(session->password_in); kfree(session->username); @@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) kfree(session->portal_type); kfree(session->discovery_parent_type); - iscsi_destroy_session(cls_session); + iscsi_free_session(cls_session); + iscsi_host_dec_session_cnt(shost); module_put(owner); } |