diff options
| author | Maurizio Lombardi <mlombard@redhat.com> | 2026-01-12 17:53:51 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-11 13:41:53 +0100 |
| commit | 3835e49e146a4e6e7787b29465f1a23379b6ec44 (patch) | |
| tree | 1b6b403cabd236f667b31b1098cddf3bdf2985ec /tools/perf/scripts/python/stackcollapse.py | |
| parent | 108cbf2b7d2954eb2346dc58038b5a58679461e7 (diff) | |
| download | kernel-3835e49e146a4e6e7787b29465f1a23379b6ec44.tar.gz | |
scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
[ Upstream commit 9411a89e9e7135cc459178fa77a3f1d6191ae903 ]
In iscsit_dec_conn_usage_count(), the function calls complete() while
holding the conn->conn_usage_lock. As soon as complete() is invoked, the
waiter (such as iscsit_close_connection()) may wake up and proceed to free
the iscsit_conn structure.
If the waiter frees the memory before the current thread reaches
spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function
attempts to release a lock within the already-freed connection structure.
Fix this by releasing the spinlock before calling complete().
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reported-by: Zhaojuan Guo <zguo@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Link: https://patch.msgid.link/20260112165352.138606-2-mlombard@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions