tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

In iscsit_dec_session_usage_count(), the function calls complete() while
holding the sess->session_usage_lock. Similar to the connection usage count
logic, the waiter signaled by complete() (e.g., in the session release
path) may wake up and free the iscsit_session structure immediately.

This creates a race condition where the current thread may attempt to
execute spin_unlock_bh() on a session structure that has already been
deallocated, resulting in a KASAN slab-use-after-free.

To resolve this, release the session_usage_lock before calling complete()
to ensure all dereferences of the sess pointer are finished before the
waiter is allowed to proceed with deallocation.

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reported-by: Zhaojuan Guo <zguo@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Link: https://patch.msgid.link/20260112165352.138606-3-mlombard@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

Maurizio Lombardi and committed by
Martin K. Petersen 84dc6037 9411a89e

+4 -1
+4 -1
drivers/target/iscsi/iscsi_target_util.c
··· 741 741 spin_lock_bh(&sess->session_usage_lock); 742 742 sess->session_usage_count--; 743 743 744 - if (!sess->session_usage_count && sess->session_waiting_on_uc) 744 + if (!sess->session_usage_count && sess->session_waiting_on_uc) { 745 + spin_unlock_bh(&sess->session_usage_lock); 745 746 complete(&sess->session_waiting_on_uc_comp); 747 + return; 748 + } 746 749 747 750 spin_unlock_bh(&sess->session_usage_lock); 748 751 }