[PATCH -next 0/2] scsi: iscsi: Fix races in connection cleanup path

From: Ye Bin <[email protected]>

This series fixes two races in the iSCSI connection cleanup path that
were introduced by commit 23d6fefbb3f6 ("scsi: iscsi: Fix in-kernel
conn failure handling").

Patch 1 fixes a NULL pointer dereference in iscsi_sw_tcp_release_conn()
that occurs when userspace delivers STOP_CONN_TERM while the kernel has
already queued cleanup_work for the same connection. The two paths race
on tcp_sw_conn->sock: the userspace path clears it under sock_lock while
the workqueue path dereferences it locklessly in
iscsi_sw_tcp_conn_restore_callbacks(), leading to a NULL dereference.
The fix sets ISCSI_CLS_CONN_BIT_CLEANUP when userspace delivers
STOP_CONN_TERM to prevent concurrent invocation of iscsi_stop_conn().

Patch 2 fixes a use-after-free in iscsi_conn_release().
iscsi_conn_error_event() queues conn->cleanup_work without taking a
reference to the connection, so if the connection is freed (e.g. via
iscsi_remove_session() -> iscsi_iter_destroy_conn_fn()) while the work
is still pending or running, iscsi_cleanup_conn_work_fn() dereferences
freed memory. Unlike the iscsi_if_destroy_conn() and iscsi_if_stop_conn()
paths, the session teardown path does not handle the pending
cleanup_work before dropping the connection reference. The fix calls
cancel_work_sync(&conn->cleanup_work) in iscsi_conn_release() before
freeing the connection.

Ye Bin (2):
  scsi: iscsi: fix NULL pointer dereference in
    iscsi_sw_tcp_release_conn()
  scsi: iscsi: Fix use-after-free in iscsi_conn_release() for
    cleanup_work

 drivers/scsi/scsi_transport_iscsi.c | 50 +++++++++++++++++------------
 1 file changed, 30 insertions(+), 20 deletions(-)

-- 
2.34.1