From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BBB2C61DA4 for ; Mon, 6 Mar 2023 11:37:39 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A1F96280003; Mon, 6 Mar 2023 06:37:38 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 9CE7A280001; Mon, 6 Mar 2023 06:37:38 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 89681280003; Mon, 6 Mar 2023 06:37:38 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 7C8B9280001 for ; Mon, 6 Mar 2023 06:37:38 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 4552540C5D for ; Mon, 6 Mar 2023 11:37:38 +0000 (UTC) X-FDA: 80538273396.05.2CE97BD Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by imf22.hostedemail.com (Postfix) with ESMTP id B01D0C000A for ; Mon, 6 Mar 2023 11:37:35 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=none; spf=pass (imf22.hostedemail.com: domain of zhongjinghua@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=zhongjinghua@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1678102656; a=rsa-sha256; cv=none; b=yLtUyqHAOsN24EgRnQqa1K5DhOCVnPMKLgx/D9tex6BCR0Kw/0EPslRK3YKmYAlVsK0kBc T2MUZ+S7e+97iWv2NORPHd2LFmJECxQ1jR8CBjeeuSuLxQBNpDabo2iLgfMqVUcj7qjTgO vGouQHJnQQOPR3YYL54DI/X0N+KBS4I= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=none; spf=pass (imf22.hostedemail.com: domain of zhongjinghua@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=zhongjinghua@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1678102656; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MnQA9L4DgGuc8YC1jYJYPKE3kQJztit86xBDVo8DWdE=; b=STcZnhUY8+wIHw4qWlqNsy7or2Prk0ht3utinCjgDsk640Gfv7/v7idBT44yB/on9N8Vzo EQ55ZlBEgw7eFHy3BLsUrnlwTv8Gml1D+Jl5Nqsn0bIBbeI4VqIqd2dAjfIHtB6ConSsGB GmZUkGq9NK57FprqepOZjCN1Cl97QGo= Received: from kwepemm600002.china.huawei.com (unknown [172.30.72.57]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4PVc1d40N7znWSx; Mon, 6 Mar 2023 19:34:45 +0800 (CST) Received: from [10.174.178.159] (10.174.178.159) by kwepemm600002.china.huawei.com (7.193.23.29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.21; Mon, 6 Mar 2023 19:37:31 +0800 Message-ID: Date: Mon, 6 Mar 2023 19:37:30 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.6.1 Subject: Re: [PATCH-next v2] scsi: fix use-after-free problem in scsi_remove_target To: , , CC: , , , , References: <20230306115840.3156157-1-zhongjinghua@huawei.com> From: zhongjinghua In-Reply-To: <20230306115840.3156157-1-zhongjinghua@huawei.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [10.174.178.159] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemm600002.china.huawei.com (7.193.23.29) X-CFilter-Loop: Reflected X-Rspam-User: X-Rspamd-Queue-Id: B01D0C000A X-Rspamd-Server: rspam01 X-Stat-Signature: edq1w64xa5a7xpynf9iqqpgirnt37bz3 X-HE-Tag: 1678102655-906699 X-HE-Meta: U2FsdGVkX1+XdHX4gYi0NZw0GhukBSkwi6RbgJhklaHjSqq5+jSlogquT7frMa0dfkp5395B8c3brXDENqig4QcvH0QGqpOAJVnmcaHRCWn5pqyCHP19WraiiJd9y1s+ta/Hf4QGmgcMR+4CAwdq/QuArxQptMo9lanAD89Du0FcEbSffaPMFDFpBv9YFn4muzeEC61pQXe8DzGsJIMkaXazoudh/Yqvu4l9t2RE+xdY7z0lRnQy17j2LVFB7JHSCmOl3ige9uRxtGDGbmpbK1pNfGFbF9S75L8rLoek77VBsdQeKHzik3GHAVStB25cWK4hewzCjOQNj2XhudEfpbfZTmyiwSmns+PihL+7ELKH8K2lqXf6ucAn/KAi3cDKkjFsfjJhyG7s8SBHIZ0LX3HuwW3xPo0+NP0eH+gqFjBJzwTB+KJ/gQoiVRpUo+1HHja16IP2CC5zVfAv37F2woPa1okv89TcoWP828o4k5jb8sUaJuIyLcQj9x3+yxsN4EAy/6ZeIEYHPjOOUcUADseEvQUB4icDvdOmbNVKUAFHmnfjuP91Ug6hX+VJzDiLbG1cmUbfWu+PnmbC5URElE0PkWbFtSq/k9fhQ9+R05dxdTItQ4stEDVpbRaM2nh6wsK7fGWbh1/1Iw/RIMJ1t2LMQHFaQ+GQP4Y9oA5K7efjMPbU/Y3t4v3EJJx5G63LjJqxbdQeCeztAsAgUvMKpxBMp+S29fn0l2D34bglH29shxw02GBWwV6F3oKlebaiIzDpIE+Iwiv08D7UD4mW7rhXYSlpsTR2riMFOCxyhddA+IN8qy22PRDyvFbqdmtBcEI8VdWBlPGU5qJ+OaZ/wnAR3NfKnsikJAnRr8oOJTxYVwZhzYCMlbzX/0DNvmVM6Db+GhbTzn9pnL0TIAe87RbzkZxh4wyC77l8T6t6bV7deODYWPpLpBwmb5/YXuBkV9gQwzm4/hwf3l+zQ+I 46eIRhW3 kAFPNxjpwlIqU+9lp7UMH/1WWKJXwsVuwSvBzJdsLmWI4OnEyPFuqnbc6ow0fyrZkOAgaSO+13PPInf3Q+yhX6YUS2/08n29o/cCVBXZcqZ5ngAK3lBSXiSce1RMwGhezK9LxhMY+Ar82oASEcd4jn89DvXGdF/VXjbwQJHBzdigYUoKzKz+65DoIJ18V1Z+WlYNPWI7/0q3BVU6paVCFZrWYN/3NUkrjJdxr X-Bogosity: Ham, tests=bogofilter, spamicity=0.032890, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: I'm sorry, I sent the wrong email 在 2023/3/6 19:58, Zhong Jinghua 写道: > A use-after-free problem like below: > > BUG: KASAN: use-after-free in scsi_target_reap+0x6c/0x70 > > Workqueue: scsi_wq_1 __iscsi_unbind_session [scsi_transport_iscsi] > Call trace: > dump_backtrace+0x0/0x320 > show_stack+0x24/0x30 > dump_stack+0xdc/0x128 > print_address_description+0x68/0x278 > kasan_report+0x1e4/0x308 > __asan_report_load4_noabort+0x30/0x40 > scsi_target_reap+0x6c/0x70 > scsi_remove_target+0x430/0x640 > __iscsi_unbind_session+0x164/0x268 [scsi_transport_iscsi] > process_one_work+0x67c/0x1350 > worker_thread+0x370/0xf90 > kthread+0x2a4/0x320 > ret_from_fork+0x10/0x18 > > The problem is caused by a concurrency scenario: > > T0: delete target > // echo 1 > /sys/devices/platform/host1/session1/target1:0:0/1:0:0:1/delete > T1: logout > // iscsiadm -m node --logout > > T0 T1 > sdev_store_delete > scsi_remove_device > device_remove_file > __scsi_remove_device > __iscsi_unbind_session > scsi_remove_target > spin_lock_irqsave > list_for_each_entry > scsi_target_reap > // starget->reap_ref 1 -> 0 > kref_get(&starget->reap_ref); > // warn use-after-free. > spin_unlock_irqrestore > scsi_target_reap_ref_release > scsi_target_destroy > ... // delete starget > scsi_target_reap > // UAF > > When T0 reduces the reference count to 0, but has not been released, > T1 can still enter list_for_each_entry, and then kref_get reports UAF. > > Fix it by using kref_get_unless_zero() to check for a reference count of > 0. > > Signed-off-by: Zhong Jinghua > --- > v2: commit message: "starget->reaf" -> "starget->reap_ref" > comment: "If it is reduced to 0, it means that other processes are releasing it and there is no need to delete it again" > -> > "If the reference count is already zero, skip this target is safe because scsi_target_destroy() will wait until the > host lock has been released before freeing starget." > > drivers/scsi/scsi_sysfs.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c > index e7893835b99a..12e8ed6d55cb 100644 > --- a/drivers/scsi/scsi_sysfs.c > +++ b/drivers/scsi/scsi_sysfs.c > @@ -1561,7 +1561,16 @@ void scsi_remove_target(struct device *dev) > starget->state == STARGET_CREATED_REMOVE) > continue; > if (starget->dev.parent == dev || &starget->dev == dev) { > - kref_get(&starget->reap_ref); > + > + /* > + * If the reference count is already zero, skip this > + * target is safe because scsi_target_destroy() > + * will wait until the host lock has been released > + * before freeing starget. > + */ > + if (!kref_get_unless_zero(&starget->reap_ref)) > + continue; > + > if (starget->state == STARGET_CREATED) > starget->state = STARGET_CREATED_REMOVE; > else