Fix a use after free in target driver

The following KASAN report has been reported
by Zhaojuan Guo <[email protected]>

==================================================================

 BUG: KASAN: slab-use-after-free in lock_release+0xd4/0x1e8
 Read of size 8 at addr ffff0000e9b2c778 by task targetctl/21319

 kasan_report+0x90/0xc8
 __asan_load8+0xb8/0xc0
 lock_release+0xd4/0x1e8
 rt_spin_unlock+0x2c/0xb8
 iscsit_dec_conn_usage_count+0x68/0xa0 [iscsi_target_mod]
 iscsit_stop_session+0x140/0x220 [iscsi_target_mod]
 iscsit_release_sessions_for_tpg+0x380/0x480 [iscsi_target_mod]
 iscsit_tpg_disable_portal_group+0x104/0x260 [iscsi_target_mod]
 lio_target_tiqn_enabletpg+0x3c/0x80 [iscsi_target_mod]
 target_tpg_disable+0x6c/0xb0 [target_core_mod]
 target_fabric_tpg_base_enable_store+0x110/0x128 [target_core_mod]
 configfs_write_iter+0x154/0x1d0
 new_sync_write+0x1c8/0x298
 vfs_write+0x2e8/0x348
 ksys_write+0xd8/0x198

 Allocated by task 20969:
  __kasan_kmalloc+0xb8/0xc0
  __kmalloc_cache_noprof+0x194/0x300
  iscsit_alloc_conn+0x48/0x4e0 [iscsi_target_mod]
  __iscsi_target_login_thread+0x108/0x960 [iscsi_target_mod]
  iscsi_target_login_thread+0x30/0x80 [iscsi_target_mod]
  kthread+0x190/0x1a8
  ret_from_fork+0x10/0x20

 Freed by task 21085:
  __kasan_slab_free+0x4c/0x70
  kfree+0x108/0x430
  iscsit_free_conn+0x74/0x90 [iscsi_target_mod]
  iscsit_close_connection+0x4ec/0xc98 [iscsi_target_mod]
  iscsit_take_action_for_connection_exit+0x114/0x270 [iscsi_target_mod]
  iscsi_target_tx_thread+0x268/0x340 [iscsi_target_mod]
  kthread+0x190/0x1a8
  ret_from_fork+0x10/0x20

I reproduced it by inserting a delay between the call to complete() and the call to spin_unlock() inside the iscsit_dec_conn_usage_count().

iscsit_dec_session_usage_count() has the same problem.

Maurizio Lombardi (2):
target: iscsi: fix use-after-free in iscsit_dec_conn_usage_count()
target: iscsi: fix use-after-free in iscsit_dec_session_usage_count()

 drivers/target/iscsi/iscsi_target_util.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

2.47.3

In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection) may wake up and proceed to free the iscsit_conn structure.

If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure.

Fix this by releasing the spinlock before calling complete().

---
 drivers/target/iscsi/iscsi_target_util.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 5e6cf34929b5..3319394bf542 100644
@@ -810,8 +810,11 @@ void iscsit_dec_conn_usage_count(struct iscsit_conn *conn)
 	spin_lock_bh(&conn->conn_usage_lock);
 	conn->conn_usage_count--;
 
-	if (!conn->conn_usage_count && conn->conn_waiting_on_uc)
+	if (!conn->conn_usage_count && conn->conn_waiting_on_uc) {
+		spin_unlock_bh(&conn->conn_usage_lock);
 		complete(&conn->conn_waiting_on_uc_comp);
+		return;
+	}
 
 	spin_unlock_bh(&conn->conn_usage_lock);
 }

2.47.3

In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsit_session structure immediately.

This creates a race condition where the current thread may attempt to execute spin_unlock_bh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free.

To resolve this, release the session_usage_lock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.

---
 drivers/target/iscsi/iscsi_target_util.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 3319394bf542..c1888c42afdd 100644
@@ -741,8 +741,11 @@ void iscsit_dec_session_usage_count(struct iscsit_session *sess)
 	spin_lock_bh(&sess->session_usage_lock);
 	sess->session_usage_count--;
 
-	if (!sess->session_usage_count && sess->session_waiting_on_uc)
+	if (!sess->session_usage_count && sess->session_waiting_on_uc) {
+		spin_unlock_bh(&sess->session_usage_lock);
 		complete(&sess->session_waiting_on_uc_comp);
+		return;
+	}
 
 	spin_unlock_bh(&sess->session_usage_lock);
 }

2.47.3