In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
IB\/isert: wait for deferred control PDU completions before releasing the connection<\/p>\n
isert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and
\nISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work
\nitem then runs isert_completion_put() -> isert_put_cmd(), which reads
\nisert_conn->conn and takes conn->cmd_lock.<\/p>\n
Nothing orders that work item against teardown. isert_wait_conn() queues
\nisert_release_work, which frees isert_conn, and iscsit_close_connection()
\nfrees the iscsit_conn right after it returns, so the queued work can run
\nagainst freed memory.<\/p>\n
Count the deferred control PDU completions per connection and let
\nisert_wait_conn() wait for them before the release work is queued.<\/p>\n
ISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs
\niscsit_logout_post_handler(), which ends up waiting for
\nconn->conn_wait_comp, and that completion is only sent by
\niscsit_close_connection() after it has called iscsit_wait_conn().
\nWaiting for it here would deadlock. Its wait stays the existing
\nisert_wait4logout().<\/p>\n
The splat below is from a kernel with tracing printk()s and an msleep(200)
\ninjected into isert_do_control_comp() to widen the window:<\/p>\n
BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d\/0x620
\n Read of size 8 at addr ffff8881054f1038 by task kworker\/u17:1\/182<\/p>\n
CPU: 0 UID: 0 PID: 182 Comm: kworker\/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)
\n Tainted: [B]=BAD_PAGE
\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\n Workqueue: isert_comp_wq isert_do_control_comp
\n Call Trace:<\/p>\n
dump_stack_lvl+0x53\/0x70
\n print_report+0xd0\/0x630
\n ? __pfx__raw_spin_lock_irqsave+0x10\/0x10
\n ? _raw_spin_unlock_irqrestore+0x3e\/0x70
\n ? isert_put_cmd+0x53d\/0x620
\n kasan_report+0xce\/0x100
\n ? isert_put_cmd+0x53d\/0x620
\n isert_put_cmd+0x53d\/0x620
\n ? isert_completion_put+0x305\/0x330
\n ? isert_do_control_comp+0x2ef\/0x310
\n process_one_work+0x633\/0x1030
\n ? assign_work+0x11d\/0x370
\n worker_thread+0x45b\/0xd10
\n ? __pfx_worker_thread+0x10\/0x10
\n ? __pfx_worker_thread+0x10\/0x10
\n kthread+0x2c6\/0x3b0
\n ? recalc_sigpending+0x15c\/0x1e0
\n ? __pfx_kthread+0x10\/0x10
\n ret_from_fork+0x36e\/0x5a0
\n ? __pfx_ret_from_fork+0x10\/0x10
\n ? __switch_to+0x572\/0xdd0
\n ? __pfx_kthread+0x10\/0x10
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Allocated by task 48:
\n kasan_save_stack+0x33\/0x60
\n kasan_save_track+0x14\/0x30
\n __kasan_kmalloc+0x8f\/0xa0
\n __kmalloc_cache_noprof+0x158\/0x370
\n isert_cma_handler+0x1e3\/0x2ae0
\n cma_cm_event_handler+0x3e\/0x240
\n cma_ib_req_handler+0x17d9\/0x4490
\n cm_process_work+0x41\/0x330
\n cm_work_handler+0x5727\/0xc160
\n process_one_work+0x633\/0x1030
\n worker_thread+0x45b\/0xd10
\n kthread+0x2c6\/0x3b0
\n ret_from_fork+0x36e\/0x5a0
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Freed by task 184:
\n kasan_save_stack+0x33\/0x60
\n kasan_save_track+0x14\/0x30
\n kasan_save_free_info+0x3b\/0x60
\n __kasan_slab_free+0x43\/0x70
\n kfree+0x121\/0x380
\n iscsit_close_connection+0x7cf\/0x1e60
\n iscsit_take_action_for_connection_exit+0x1b6\/0x360
\n iscsi_target_tx_thread+0x472\/0x690
\n kthread+0x2c6\/0x3b0
\n ret_from_fork+0x36e\/0x5a0
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
IB\/isert: wait for deferred control PDU completions before releasing the connection<\/p>\n
isert_send_done() hands ISTATE_SEND_TASKMGTRSP<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33426","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}