[5.4,091/191] scsi: target: core: Release SPC-2 reservations when closing a session

From: Bart Van Assche <bvanassche@acm.org>

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit 80647a89eaf3f2549741648f3230cd6ff68c23b4 ]

The SCSI specs require releasing SPC-2 reservations when a session is
closed. Make sure that the target core does this.

Running the libiscsi tests triggers the KASAN complaint shown below.  This
patch fixes that use-after-free.

BUG: KASAN: use-after-free in target_check_reservation+0x171/0x980 [target_core_mod]
Read of size 8 at addr ffff88802ecd1878 by task iscsi_trx/17200

CPU: 0 PID: 17200 Comm: iscsi_trx Not tainted 5.4.0-rc1-dbg+ #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
 dump_stack+0x8a/0xd6
 print_address_description.constprop.0+0x40/0x60
 __kasan_report.cold+0x1b/0x34
 kasan_report+0x16/0x20
 __asan_load8+0x58/0x90
 target_check_reservation+0x171/0x980 [target_core_mod]
 __target_execute_cmd+0xb1/0xf0 [target_core_mod]
 target_execute_cmd+0x22d/0x4d0 [target_core_mod]
 transport_generic_new_cmd+0x31f/0x5b0 [target_core_mod]
 transport_handle_cdb_direct+0x6f/0x90 [target_core_mod]
 iscsit_execute_cmd+0x381/0x3f0 [iscsi_target_mod]
 iscsit_sequence_cmd+0x13b/0x1f0 [iscsi_target_mod]
 iscsit_process_scsi_cmd+0x4c/0x130 [iscsi_target_mod]
 iscsit_get_rx_pdu+0x8e8/0x15f0 [iscsi_target_mod]
 iscsi_target_rx_thread+0x105/0x1b0 [iscsi_target_mod]
 kthread+0x1bc/0x210
 ret_from_fork+0x24/0x30

Allocated by task 1079:
 save_stack+0x23/0x90
 __kasan_kmalloc.constprop.0+0xcf/0xe0
 kasan_slab_alloc+0x12/0x20
 kmem_cache_alloc+0xfe/0x3a0
 transport_alloc_session+0x29/0x80 [target_core_mod]
 iscsi_target_login_thread+0xceb/0x1920 [iscsi_target_mod]
 kthread+0x1bc/0x210
 ret_from_fork+0x24/0x30

Freed by task 17193:
 save_stack+0x23/0x90
 __kasan_slab_free+0x13a/0x190
 kasan_slab_free+0x12/0x20
 kmem_cache_free+0xc8/0x3e0
 transport_free_session+0x179/0x2f0 [target_core_mod]
 transport_deregister_session+0x121/0x170 [target_core_mod]
 iscsit_close_session+0x12c/0x350 [iscsi_target_mod]
 iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod]
 iscsit_response_queue+0x8fa/0xc00 [iscsi_target_mod]
 iscsi_target_tx_thread+0x28e/0x390 [iscsi_target_mod]
 kthread+0x1bc/0x210
 ret_from_fork+0x24/0x30

The buggy address belongs to the object at ffff88802ecd1860
 which belongs to the cache se_sess_cache of size 352
The buggy address is located 24 bytes inside of
 352-byte region [ffff88802ecd1860, ffff88802ecd19c0)
The buggy address belongs to the page:
page:ffffea0000bb3400 refcount:1 mapcount:0 mapping:ffff8880bef2ed00 index:0x0 compound_mapcount: 0
flags: 0x1000000000010200(slab|head)
raw: 1000000000010200 dead000000000100 dead000000000122 ffff8880bef2ed00
raw: 0000000000000000 0000000080270027 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88802ecd1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802ecd1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802ecd1800: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
                                                                ^
 ffff88802ecd1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802ecd1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Cc: Mike Christie <mchristi@redhat.com>
Link: https://lore.kernel.org/r/20191113220508.198257-2-bvanassche@acm.org
Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_transport.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

Message ID	20200102215839.679018970@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=x1Uk=2X=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Mike Christie <mchristi@redhat.com>, Roman Bolshakov <r.bolshakov@yadro.com>, Bart Van Assche <bvanassche@acm.org>, "Martin K. Petersen" <martin.petersen@oracle.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.4 091/191] scsi: target: core: Release SPC-2 reservations when closing a session Date: Thu, 2 Jan 2020 23:06:13 +0100 Message-Id: <20200102215839.679018970@linuxfoundation.org> In-Reply-To: <20200102215829.911231638@linuxfoundation.org> References: <20200102215829.911231638@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.4,004/191] scsi: lpfc: Fix discovery failures when target device connectivity bounces [5.4,006/191] scsi: lpfc: Fix locking on mailbox command completion [5.4,008/191] gpio: mxc: Only get the second IRQ when there is more than one IRQ [5.4,010/191] Input: atmel_mxt_ts - disable IRQ across suspend [5.4,012/191] powerpc/papr_scm: Fix an off-by-one check in papr_scm_meta_{get, set} [5.4,013/191] tools/power/x86/intel-speed-select: Remove warning for unused result [5.4,015/191] iommu: rockchip: Free domain on .domain_free [5.4,017/191] dmaengine: xilinx_dma: Clear desc_pendingcount in xilinx_dma_reset [5.4,018/191] scsi: target: compare full CHAP_A Algorithm strings [5.4,019/191] scsi: lpfc: Fix hardlockup in lpfc_abort_handler [5.4,022/191] scsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec() [5.4,023/191] scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails [5.4,024/191] powerpc/pseries: Mark accumulate_stolen_time() as notrace [5.4,027/191] selftests/powerpc: Fixup clobbers for TM tests [5.4,029/191] dma-debug: add a schedule point in debug_dma_dump_mappings() [5.4,031/191] dma-mapping: fix handling of dma-ranges for reserved memory (again) [5.4,033/191] leds: lm3692x: Handle failure to probe the regulator [5.4,035/191] leds: trigger: netdev: fix handling on interface rename [5.4,037/191] clocksource/drivers/timer-of: Use unique device name instead of timer [5.4,039/191] selftests/powerpc: Skip tm-signal-sigreturn-nt if TM not available [5.4,042/191] ext4: update direct I/O read lock pattern for IOCB_NOWAIT [5.4,043/191] ext4: iomap that extends beyond EOF should be marked dirty [5.4,044/191] jbd2: Fix statistics for the number of logged blocks [5.4,046/191] scsi: lpfc: Fix unexpected error messages during RSCN handling [5.4,049/191] clk: qcom: smd: Add missing pnoc clock [5.4,052/191] irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary [5.4,054/191] dma-direct: check for overflows on 32 bit DMA addresses [5.4,055/191] mfd: mfd-core: Honour Device Trees request to disable a child-device [5.4,059/191] iomap: fix return value of iomap_dio_bio_actor on 32bit systems [5.4,061/191] scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences [5.4,062/191] scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane) [5.4,065/191] powerpc/pseries/cmm: Implement release() function for sysfs device [5.4,066/191] PCI: rpaphp: Dont rely on firmware feature to imply drc-info support [5.4,067/191] PCI: rpaphp: Annotate and correctly byte swap DRC properties [5.4,068/191] PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name when using drc-info [5.4,071/191] powerpc/book3s/mm: Update Oops message to print the correct translation in use [5.4,072/191] scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE [5.4,076/191] dt-bindings: Improve validation build error handling [5.4,077/191] HID: logitech-hidpp: Silence intermittent get_battery_capacity errors [5.4,079/191] ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening [5.4,082/191] HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transp... [5.4,083/191] watchdog: imx7ulp: Fix reboot hang [5.4,085/191] watchdog: Fix the race between the release of watchdog_core_data and cdev [5.4,087/191] scsi: pm80xx: Fix for SATA device discovery [5.4,088/191] scsi: ufs: Fix error handing during hibern8 enter [5.4,091/191] scsi: target: core: Release SPC-2 reservations when closing a session [5.4,092/191] scsi: ufs: Fix up auto hibern8 enablement [5.4,095/191] f2fs: Fix deadlock in f2fs_gc() context during atomic files handling [5.4,096/191] habanalabs: skip VA block list update in reset flow [5.4,098/191] platform/x86: intel_pmc_core: Fix the SoC naming inconsistency [5.4,100/191] gpio: mpc8xxx: Dont overwrite default irq_set_type callback [5.4,101/191] gpio: lynxpoint: Setup correct IRQ handlers [5.4,106/191] scripts/kallsyms: fix definitely-lost memory leak [5.4,108/191] f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_proje... [5.4,109/191] cifs: Fix use-after-free bug in cifs_reconnect() [5.4,112/191] of: unittest: fix memory leak in attach_node_and_children [5.4,115/191] perf diff: Use llabs() with 64-bit values [5.4,117/191] perf regs: Make perf_reg_name() return "unknown" instead of NULL [5.4,118/191] s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR [5.4,120/191] libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h [5.4,122/191] s390/cpum_sf: Check for SDBT and SDB consistency [5.4,123/191] ocfs2: fix passing zero to PTR_ERR warning [5.4,125/191] s390: disable preemption when switching to nodat stack with CALL_ON_STACK [5.4,126/191] selftests: vm: add fragment CONFIG_TEST_VMALLOC [5.4,127/191] mm/hugetlbfs: fix error handling when setting up mounts [5.4,131/191] sctp: fix err handling of stream initialization [5.4,133/191] Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection" [5.4,135/191] 6pack,mkiss: fix possible deadlock [5.4,137/191] net/smc: add fallback check to connect() [5.4,140/191] net: add a READ_ONCE() in skb_peek_tail() [5.4,141/191] net: icmp: fix data-race in cmp_global_allow() [5.4,143/191] tomoyo: Dont use nifty names on sockets. [5.4,144/191] uaccess: disallow > INT_MAX copy sizes [5.4,145/191] drm: limit to INT_MAX in create_blob ioctl [5.4,147/191] cxgb4/cxgb4vf: fix flow control display for auto negotiation [5.4,149/191] net/mlxfw: Fix out-of-memory error in mfa2 flash burning [5.4,151/191] net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device [5.4,152/191] net/sched: add delete_empty() to filters and use it in cls_flower [5.4,155/191] ptp: fix the race between the release of ptp_clock and cdev [5.4,156/191] tcp: Fix highest_sack and highest_sack_seq [5.4,158/191] bnxt_en: Fix MSIX request logic for RDMA driver. [5.4,162/191] bnxt_en: Remove unnecessary NULL checks for fw_health [5.4,164/191] bnxt_en: Add missing devlink health reporters for VFs. [5.4,165/191] mlxsw: spectrum_router: Skip loopback RIFs during MAC validation [5.4,167/191] net: add bool confirm_neigh parameter for dst_ops.update_pmtu [5.4,170/191] net/dst: add new function skb_dst_update_pmtu_no_confirm [5.4,172/191] vti: do not confirm neighbor when do pmtu update [5.4,173/191] sit: do not confirm neighbor when do pmtu update [5.4,175/191] net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S [5.4,178/191] gtp: avoid zero size hashtable [5.4,181/191] tcp/dccp: fix possible race __inet_lookup_established() [5.4,183/191] gtp: fix an use-after-free in ipv4_pdp_find() [5.4,184/191] gtp: do not allow adding duplicate tid and ms_addr pdp context [5.4,186/191] ipv6/addrconf: only check invalid header values when NETLINK_F_STRICT_CHK is set [5.4,187/191] net: phylink: fix interface passed to mac_link_up

[5.4,091/191] scsi: target: core: Release SPC-2 reservations when closing a session

Commit Message

Patch