Commit 9411a89e authored by Maurizio Lombardi's avatar Maurizio Lombardi Committed by Martin K. Petersen
Browse files

scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() 



In iscsit_dec_conn_usage_count(), the function calls complete() while
holding the conn->conn_usage_lock. As soon as complete() is invoked, the
waiter (such as iscsit_close_connection()) may wake up and proceed to free
the iscsit_conn structure.

If the waiter frees the memory before the current thread reaches
spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function
attempts to release a lock within the already-freed connection structure.

Fix this by releasing the spinlock before calling complete().

Signed-off-by: default avatarMaurizio Lombardi <mlombard@redhat.com>
Reported-by: default avatarZhaojuan Guo <zguo@redhat.com>
Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Link: https://patch.msgid.link/20260112165352.138606-2-mlombard@redhat.com


Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent fe2f8ad6

drivers/target/iscsi/iscsi_target_util.c

+4 −1
Original line number Diff line number Diff line
@@ -810,8 +810,11 @@ void iscsit_dec_conn_usage_count(struct iscsit_conn *conn) 
	spin_lock_bh(&conn->conn_usage_lock);

	conn->conn_usage_count--;



	if (!conn->conn_usage_count && conn->conn_waiting_on_uc)

	if (!conn->conn_usage_count && conn->conn_waiting_on_uc) {

		spin_unlock_bh(&conn->conn_usage_lock);

		complete(&conn->conn_waiting_on_uc_comp);

		return;

	}



	spin_unlock_bh(&conn->conn_usage_lock);

}