linux-stable/drivers/scsi
Mike Christie d4d765f476 scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
[ Upstream commit f484a794e4 ]

If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,
userspace could be accessing the host's ipaddress attr. If we then free the
session via iscsi_session_teardown() while userspace is still accessing the
session we will hit a use after free bug.

Set the tcp_sw_host->session after we have completed session creation and
can no longer fail.

Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Acked-by: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-22 12:50:25 +01:00
..
aacraid scsi: aacraid: Fix error handling paths in aac_probe_one() 2020-10-01 13:17:56 +02:00
aic7xxx scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 2021-07-25 14:35:12 +02:00
aic94xx scsi: libsas: Add LUN number check in .slave_alloc callback 2021-07-25 14:35:13 +02:00
arcmsr
arm scsi: eesox: Fix different dev_id between request_irq() and free_irq() 2020-08-19 08:16:09 +02:00
be2iscsi scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() 2021-07-20 16:10:53 +02:00
bfa scsi: bfa: Replace snprintf() with sysfs_emit() 2022-04-15 14:18:32 +02:00
bnx2fc scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe 2022-02-08 18:24:33 +01:00
bnx2i scsi: iscsi: Fix shost->max_id use 2021-07-20 16:10:43 +02:00
csiostor scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() 2021-11-17 09:48:43 +01:00
cxgbi scsi: iscsi: Fix shost->max_id use 2021-07-20 16:10:43 +02:00
cxlflash scsi: cxlflash: Fix error return code in cxlflash_probe() 2020-10-01 13:18:02 +02:00
device_handler scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() 2021-08-26 08:36:14 -04:00
dpt
esas2r scsi: esas2r: unlock on error in esas2r_nvram_read_direct() 2020-01-23 08:22:58 +01:00
fcoe scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails 2023-01-18 11:41:20 +01:00
fnic scsi: fnic: Fix memleak in vnic_dev_init_devcmd2 2021-02-07 15:35:48 +01:00
hisi_sas scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id 2023-02-06 07:52:42 +01:00
ibmvscsi scsi: ibmvfc: Fix invalid state machine BUG_ON() 2021-05-14 09:44:25 +02:00
ibmvscsi_tgt scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 2022-04-20 09:19:36 +02:00
isci scsi: libsas: Add LUN number check in .slave_alloc callback 2021-07-25 14:35:13 +02:00
libfc scsi: libfc: Fix use after free in fc_exch_abts_resp() 2022-04-15 14:18:34 +02:00
libsas scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() 2022-10-26 13:22:41 +02:00
lpfc scsi: lpfc: Add missing destroy_workqueue() in error path 2022-09-15 12:04:54 +02:00
megaraid scsi: megaraid_sas: Fix double kfree() 2022-09-15 12:04:53 +02:00
mpt3sas scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() 2023-01-18 11:41:19 +01:00
mvsas scsi: mvsas: Add PCI ID of RocketRaid 2640 2022-04-20 09:19:37 +02:00
pcmcia scsi: fdomain: Fix error return code in fdomain_probe() 2021-09-22 12:26:24 +02:00
pm8001 scsi: pm8001: Fix pm8001_mpi_task_abort_resp() 2022-04-15 14:18:33 +02:00
qedf scsi: qedf: Fix a UAF bug in __qedf_probe() 2022-10-15 07:54:37 +02:00
qedi scsi: qedi: Fix failed disconnect handling 2022-04-27 13:50:48 +02:00
qla2xxx scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection 2022-08-25 11:18:10 +02:00
qla4xxx scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()' 2020-10-29 09:57:36 +01:00
smartpqi scsi: smartpqi: Fix DMA direction for RAID requests 2022-08-25 11:17:56 +02:00
snic scsi: snic: Fix possible UAF in snic_tgt_create() 2023-01-18 11:41:20 +01:00
sym53c8xx_2
ufs scsi: ufs: host: Hold reference returned by of_parse_phandle() 2022-08-03 11:59:38 +02:00
.gitignore
3w-9xxx.c scsi: 3w-9xxx: Avoid disabling device if failing to enable it 2022-10-26 13:22:56 +02:00
3w-9xxx.h
3w-sas.c
3w-sas.h
3w-xxxx.c
3w-xxxx.h
53c700.c
53c700.h
53c700.scr
53c700_d.h_shipped
a100u2w.c
a100u2w.h
a2091.c
a2091.h
a3000.c
a3000.h
a4000t.c
advansys.c scsi: advansys: Fix kernel pointer leak 2021-11-26 10:47:15 +01:00
aha152x.c scsi: aha152x: Fix aha152x_setup() __setup handler return value 2022-04-15 14:18:34 +02:00
aha152x.h
aha1542.c
aha1542.h
aha1740.c
aha1740.h
am53c974.c
atari_scsi.c scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE 2020-01-04 19:18:10 +01:00
atp870u.c
atp870u.h
BusLogic.c scsi: BusLogic: Fix missing pr_cont() use 2021-09-22 12:26:37 +02:00
BusLogic.h scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic 2021-06-03 08:59:11 +02:00
bvme6000_scsi.c
ch.c scsi: ch: Make it possible to open a ch device multiple times again 2019-10-09 23:39:35 -04:00
constants.c
dc395x.c scsi: dc395x: Fix a missing check on list iterator 2022-06-14 18:11:46 +02:00
dc395x.h
dmx3191d.c
dpt_i2o.c
dpti.h
esp_scsi.c
esp_scsi.h
fdomain.c
fdomain.h
fdomain_isa.c
fdomain_pci.c
FlashPoint.c scsi: FlashPoint: Rename si_flags field 2021-07-14 16:53:41 +02:00
g_NCR5380.c
gdth.c
gdth.h
gdth_ioctl.h
gdth_proc.c
gdth_proc.h
gvp11.c
gvp11.h
hosts.c scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() 2021-10-27 09:54:29 +02:00
hpsa.c scsi: hpsa: Fix allocation size for scsi_host_alloc() 2023-02-06 07:52:43 +01:00
hpsa.h
hpsa_cmd.h
hptiop.c
hptiop.h
imm.c
imm.h
initio.c
initio.h
ipr.c scsi: ipr: Fix WARNING in ipr_init() 2023-01-18 11:41:20 +01:00
ipr.h scsi: ipr: Fix softlockup when rescanning devices in petitboot 2020-04-01 11:01:54 +02:00
ips.c
ips.h
iscsi_boot_sysfs.c scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj 2020-06-24 17:50:37 +02:00
iscsi_tcp.c scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress 2023-02-22 12:50:25 +01:00
iscsi_tcp.h
jazz_esp.c scsi: jazz_esp: Add IRQ check 2021-05-14 09:44:25 +02:00
Kconfig scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled 2020-07-22 09:32:57 +02:00
lasi700.c
libiscsi.c scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() 2022-01-11 15:23:33 +01:00
libiscsi_tcp.c
mac53c94.c
mac53c94.h
mac_esp.c
mac_scsi.c scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE 2020-01-04 19:18:10 +01:00
Makefile
megaraid.c scsi: megaraid: Fix error check return value of register_chrdev() 2022-06-14 18:11:26 +02:00
megaraid.h
mesh.c scsi: mesh: Fix panic after host or bus reset 2020-08-19 08:16:15 +02:00
mesh.h
mvme16x_scsi.c
mvme147.c
mvme147.h
mvumi.c scsi: mvumi: Fix error return in mvumi_io_attach() 2020-10-29 09:58:04 +01:00
mvumi.h
myrb.c scsi: myrb: Fix up null pointer access on myrb_cleanup() 2022-06-14 18:12:00 +02:00
myrb.h
myrs.c scsi: myrs: Fix crash in error case 2022-02-16 12:52:49 +01:00
myrs.h
ncr53c8xx.c
ncr53c8xx.h
NCR5380.c scsi: NCR5380: Add disconnect_mask module parameter 2020-01-04 19:18:16 +01:00
NCR5380.h
nsp32.c
nsp32.h
nsp32_debug.c
nsp32_io.h
pmcraid.c scsi: pmcraid: Fix missing resource cleanup in error case 2022-06-22 14:11:20 +02:00
pmcraid.h
ppa.c
ppa.h
ps3rom.c
qla1280.c
qla1280.h
qlogicfas.c
qlogicfas408.c
qlogicfas408.h
qlogicpti.c
qlogicpti.h
raid_class.c
script_asm.pl
scsi.c scsi: core: Put LLD module refcnt after SCSI device is released 2021-11-06 13:59:44 +01:00
scsi.h
scsi_common.c
scsi_debug.c scsi: scsi_debug: Fix a warning in resp_write_scat() 2023-01-18 11:41:18 +01:00
scsi_debugfs.c scsi: core: Show SCMD_LAST in text form 2022-01-27 09:19:52 +01:00
scsi_debugfs.h
scsi_devinfo.c scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V 2021-06-18 09:58:59 +02:00
scsi_dh.c scsi: dh: Add Fujitsu device to devinfo and dh lists 2020-07-29 10:18:27 +02:00
scsi_error.c scsi: core: save/restore command resid for error handling 2019-10-03 21:43:04 -04:00
scsi_ioctl.c
scsi_lib.c scsi: core: Fix race between handling STS_RESOURCE and completion 2022-08-03 11:59:41 +02:00
scsi_lib_dma.c
scsi_logging.c
scsi_logging.h
scsi_netlink.c
scsi_pm.c scsi: pm: Balance pm_only counter of request queue during system resume 2020-06-07 13:18:50 +02:00
scsi_priv.h
scsi_proc.c
scsi_sas_internal.h
scsi_scan.c scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" 2023-02-22 12:50:23 +01:00
scsi_sysctl.c
scsi_sysfs.c scsi: core: Restrict legal sdev_state transitions via sysfs 2022-11-10 17:57:53 +01:00
scsi_trace.c scsi: core: scsi_trace: Use get_unaligned_be*() 2020-01-23 08:22:59 +01:00
scsi_transport_api.h
scsi_transport_fc.c
scsi_transport_iscsi.c scsi: iscsi: Unblock session then wake up error handler 2021-12-08 09:01:09 +01:00
scsi_transport_sas.c scsi: scsi_transport_sas: Fix memory leak when removing devices 2020-01-23 08:22:58 +01:00
scsi_transport_spi.c scsi: scsi_transport_spi: Set RQF_PM for domain validation commands 2021-01-12 20:16:09 +01:00
scsi_transport_srp.c scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state 2021-04-21 12:56:14 +02:00
scsicam.c
sd.c scsi: sd: Free scsi_disk device via put_device() 2021-10-09 14:39:49 +02:00
sd.h
sd_dif.c
sd_zbc.c scsi: sd_zbc: Fix sd_zbc_complete() 2019-11-05 23:17:53 -05:00
sense_codes.h
ses.c scsi: ses: Fix unsigned comparison with less than zero 2021-10-17 10:42:34 +02:00
sg.c scsi: sg: Allow waiting for commands to complete on removed device 2022-08-25 11:18:17 +02:00
sgiwd93.c
sim710.c
sni_53c710.c scsi: sni_53c710: Add IRQ check 2021-05-14 09:44:25 +02:00
sr.c scsi: sr: Don't use GFP_DMA 2022-01-27 09:19:48 +01:00
sr.h
sr_ioctl.c
sr_vendor.c scsi: sr: Don't use GFP_DMA 2022-01-27 09:19:48 +01:00
st.c scsi: st: Fix a use after free in st_open() 2021-04-07 14:47:39 +02:00
st.h
st_options.h
stex.c scsi: stex: Properly zero out the passthrough command structure 2022-10-15 07:54:39 +02:00
storvsc_drv.c scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq 2022-09-05 10:27:44 +02:00
sun3_scsi.c scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE 2020-01-04 19:18:10 +01:00
sun3_scsi_vme.c
sun3x_esp.c scsi: sun3x_esp: Add IRQ check 2021-05-14 09:44:25 +02:00
sun_esp.c
virtio_scsi.c scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" 2021-10-17 10:42:34 +02:00
vmw_pvscsi.c scsi: vmw_pvscsi: Set residual data length conditionally 2022-01-05 12:37:46 +01:00
vmw_pvscsi.h scsi: vmw_pvscsi: Expand vcpuHint to 16 bits 2022-06-22 14:11:20 +02:00
wd33c93.c
wd33c93.h
wd719x.c
wd719x.h
xen-scsifront.c xen/scsifront: don't use gnttab_query_foreign_access() for mapped status 2022-03-11 11:22:39 +01:00
zalon.c
zorro7xx.c scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() 2022-04-15 14:18:37 +02:00
zorro_esp.c scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane) 2020-01-04 19:17:37 +01:00