TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
89991ededcb557dcfe6398fa37eb182d01cfe257
twx-linux/drivers/scsi
T
History
Mike Christie 9758ffe1c0 scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress 
[ Upstream commit f484a794e4 ]

If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,
userspace could be accessing the host's ipaddress attr. If we then free the
session via iscsi_session_teardown() while userspace is still accessing the
session we will hit a use after free bug.

Set the tcp_sw_host->session after we have completed session creation and
can no longer fail.

Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Acked-by: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-15 17:22:15 +01:00
..
aacraid
…
aic7xxx
…
aic94xx
…
arcmsr
…
arm
…
be2iscsi
scsi: iscsi: Rel ref after iscsi_lookup_endpoint()
2022-04-20 09:23:16 +02:00
bfa
scsi: bfa: Replace snprintf() with sysfs_emit()
2022-04-13 21:00:55 +02:00
bnx2fc
…
bnx2i
scsi: iscsi: Rel ref after iscsi_lookup_endpoint()
2022-04-20 09:23:16 +02:00
csiostor
…
cxgbi
scsi: iscsi: Rel ref after iscsi_lookup_endpoint()
2022-04-20 09:23:16 +02:00
cxlflash
…
device_handler
…
dpt
…
esas2r
…
fcoe
scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
2023-01-14 10:15:52 +01:00
fnic
…
hisi_sas
scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
2023-02-01 08:23:17 +01:00
ibmvscsi
scsi: ibmvfc: Avoid path failures during live migration
2022-12-02 17:39:58 +01:00
ibmvscsi_tgt
scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
2022-04-20 09:23:21 +02:00
isci
…
libfc
scsi: libfc: Fix use after free in fc_exch_abts_resp()
2022-04-13 21:00:59 +02:00
libsas
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
2022-10-26 13:25:37 +02:00
lpfc
scsi: lpfc: Add missing destroy_workqueue() in error path
2022-09-15 11:32:04 +02:00
megaraid
scsi: megaraid_sas: Fix double kfree()
2022-09-15 11:32:02 +02:00
mpt3sas
scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
2023-01-14 10:15:51 +01:00
mvsas
scsi: mvsas: Add PCI ID of RocketRaid 2640
2022-04-20 09:23:24 +02:00
pcmcia
…
pm8001
scsi: pm80xx: Enable upper inbound, outbound queues
2022-04-20 09:23:15 +02:00
qedf
scsi: qedf: Populate sysfs attributes for vport
2022-10-26 13:25:11 +02:00
qedi
scsi: qedi: Fix failed disconnect handling
2022-04-27 13:53:54 +02:00
qla2xxx
scsi: qla2xxx: Use transport-defined speed mask for supported_speeds
2022-11-03 23:57:50 +09:00
qla4xxx
scsi: iscsi: Rel ref after iscsi_lookup_endpoint()
2022-04-20 09:23:16 +02:00
smartpqi
scsi: smartpqi: Fix DMA direction for RAID requests
2022-08-21 15:15:59 +02:00
snic
scsi: snic: Fix possible UAF in snic_tgt_create()
2023-01-14 10:15:52 +01:00
sym53c8xx_2
…
ufs
scsi: ufs: core: Enable link lost interrupt
2022-08-31 17:15:24 +02:00
.gitignore
…
3w-9xxx.c
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
2022-10-26 13:25:52 +02:00
3w-9xxx.h
…
3w-sas.c
…
3w-sas.h
…
3w-xxxx.c
…
3w-xxxx.h
…
53c700_d.h_shipped
…
53c700.c
…
53c700.h
…
53c700.scr
…
a100u2w.c
…
a100u2w.h
…
a2091.c
…
a2091.h
…
a3000.c
…
a3000.h
…
a4000t.c
…
advansys.c
…
aha152x.c
scsi: aha152x: Fix aha152x_setup() __setup handler return value
2022-04-13 21:00:58 +02:00
aha152x.h
…
aha1542.c
…
aha1542.h
…
aha1740.c
…
aha1740.h
…
am53c974.c
…
atari_scsi.c
…
atp870u.c
…
atp870u.h
…
BusLogic.c
…
BusLogic.h
…
bvme6000_scsi.c
…
ch.c
…
constants.c
…
dc395x.c
scsi: dc395x: Fix a missing check on list iterator
2022-06-09 10:21:24 +02:00
dc395x.h
…
dmx3191d.c
…
dpt_i2o.c
…
dpti.h
…
esp_scsi.c
…
esp_scsi.h
…
fdomain_isa.c
…
fdomain_pci.c
…
fdomain.c
…
fdomain.h
…
FlashPoint.c
…
g_NCR5380.c
…
gdth_ioctl.h
…
gdth_proc.c
…
gdth_proc.h
…
gdth.c
…
gdth.h
…
gvp11.c
…
gvp11.h
…
hosts.c
…
hpsa_cmd.h
…
hpsa.c
scsi: hpsa: Fix allocation size for scsi_host_alloc()
2023-02-01 08:23:21 +01:00
hpsa.h
…
hptiop.c
…
hptiop.h
…
imm.c
…
imm.h
…
initio.c
…
initio.h
…
ipr.c
scsi: ipr: Fix WARNING in ipr_init()
2023-01-14 10:15:52 +01:00
ipr.h
…
ips.c
…
ips.h
…
iscsi_boot_sysfs.c
…
iscsi_tcp.c
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
2023-02-15 17:22:15 +01:00
iscsi_tcp.h
scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
2022-10-26 13:25:37 +02:00
jazz_esp.c
…
Kconfig
…
lasi700.c
…
libiscsi_tcp.c
…
libiscsi.c
scsi: iscsi: Stop queueing during ep_disconnect
2022-04-20 09:23:15 +02:00
mac53c94.c
…
mac53c94.h
…
mac_esp.c
…
mac_scsi.c
…
Makefile
…
megaraid.c
scsi: megaraid: Fix error check return value of register_chrdev()
2022-06-09 10:20:52 +02:00
megaraid.h
…
mesh.c
…
mesh.h
…
mvme16x_scsi.c
…
mvme147.c
…
mvme147.h
…
mvumi.c
…
mvumi.h
…
myrb.c
scsi: myrb: Fix up null pointer access on myrb_cleanup()
2022-06-14 18:32:43 +02:00
myrb.h
…
myrs.c
…
myrs.h
…
ncr53c8xx.c
…
ncr53c8xx.h
…
NCR5380.c
…
NCR5380.h
…
nsp32_debug.c
…
nsp32_io.h
…
nsp32.c
…
nsp32.h
…
pmcraid.c
scsi: pmcraid: Fix missing resource cleanup in error case
2022-06-22 14:13:15 +02:00
pmcraid.h
…
ppa.c
…
ppa.h
…
ps3rom.c
…
qla1280.c
…
qla1280.h
…
qlogicfas408.c
…
qlogicfas408.h
…
qlogicfas.c
…
qlogicpti.c
…
qlogicpti.h
…
raid_class.c
…
script_asm.pl
…
scsi_common.c
…
scsi_debug.c
scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
2023-01-14 10:15:52 +01:00
scsi_debugfs.c
…
scsi_debugfs.h
…
scsi_devinfo.c
…
scsi_dh.c
…
scsi_error.c
scsi: core: Fix a race between scsi_done() and scsi_timeout()
2023-01-14 10:15:46 +01:00
scsi_ioctl.c
…
scsi_lib_dma.c
…
scsi_lib.c
…
scsi_logging.c
…
scsi_logging.h
…
scsi_netlink.c
…
scsi_pm.c
…
scsi_priv.h
…
scsi_proc.c
…
scsi_sas_internal.h
…
scsi_scan.c
scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
2023-02-15 17:22:11 +01:00
scsi_sysctl.c
…
scsi_sysfs.c
scsi: core: Restrict legal sdev_state transitions via sysfs
2022-11-10 18:14:22 +01:00
scsi_trace.c
…
scsi_transport_api.h
…
scsi_transport_fc.c
…
scsi_transport_iscsi.c
scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace
2023-02-01 08:23:16 +01:00
scsi_transport_sas.c
scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
2022-12-02 17:39:56 +01:00
scsi_transport_spi.c
…
scsi_transport_srp.c
…
scsi.c
…
scsi.h
…
scsicam.c
…
sd_dif.c
…
sd_zbc.c
…
sd.c
scsi: sd: Revert "scsi: sd: Remove a local variable"
2022-11-03 23:57:54 +09:00
sd.h
…
sense_codes.h
…
ses.c
…
sg.c
scsi: sg: Allow waiting for commands to complete on removed device
2022-08-21 15:15:24 +02:00
sgiwd93.c
…
sim710.c
…
sni_53c710.c
…
sr_ioctl.c
…
sr_vendor.c
…
sr.c
…
sr.h
…
st_options.h
…
st.c
…
st.h
…
stex.c
scsi: stex: Properly zero out the passthrough command structure
2022-10-15 07:55:55 +02:00
storvsc_drv.c
scsi: storvsc: Fix handling of srb_status and capacity change events
2022-12-02 17:39:59 +01:00
sun3_scsi_vme.c
…
sun3_scsi.c
…
sun3x_esp.c
…
sun_esp.c
…
virtio_scsi.c
…
vmw_pvscsi.c
…
vmw_pvscsi.h
scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
2022-06-22 14:13:14 +02:00
wd33c93.c
…
wd33c93.h
…
wd719x.c
…
wd719x.h
…
xen-scsifront.c
…
zalon.c
…
zorro7xx.c
scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
2022-04-13 21:01:04 +02:00
zorro_esp.c
…