From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B8AF73DF007 for ; Wed, 5 Aug 2026 06:54:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785912851; cv=none; b=F1cynKgaN/2KHcUOOk2+6ldqvfRHno4iz65WlKHHkJUwAFwBxRjbTW7dPnomWCqt1x0f6TONM3+94bOmVGl0kvRu313wk+HQJkgBZeziawMt81wY+gKrc2eP9PpZbt2k/J/wizaZt76sBiRMdrRvWjg8UDdx1/hiEPIh6lG70/c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785912851; c=relaxed/simple; bh=HqgE/iW+eE/eiPaxSt8xbys7nNXqvy8TA9ls2Ynusyg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Kag8LO2IeizvugJcpNK+XqaJbk3+6Un6cjZah6eXw4ZUjwAzBbpiVrjxLDw1TsKXO8BzBmUu3nh6TT6/1/x+MWC7dzpLgU3A+FjxrSyqkOt6XVcRO4UEey48pLG7fTvqGK0z7Esg0l4mrRaOX7ILdXA9cCcUbrsMGum1rn3uZho= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VMRWuyKJ; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VMRWuyKJ" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38e07ebd263so419296a91.1 for ; Tue, 04 Aug 2026 23:54:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785912838; x=1786517638; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=1hVVe+2SEo04ryaB7GG9pOTNlQvAC9QD/BxdsX78cJA=; b=VMRWuyKJNCny3SCr5e7qviCaSpHTIlQrbC8cpJ1Eb9WQB0gAkLP+jPI2gRU+oeBR9S j+Yv2n1adAzvAxajivOyDp02W5VpkxQYiiR5whghefli8AS98e9Y3dmd8ogdpeTUgJHe CSkvqqY0oMPf9oPw0v0+Pmjcb6jlzDqpYp+5/oWyp9MR6mlybw3+FE0ggciiQlsNV2j6 6sL4DWOa6burtskTr46wZ3erRkieRLN6inz0YI6jH5o3vTmQgsivr2ThkEFwhLevKhgu mWJQX50YX+IJd6CSAiQrP2vuHja5xAQF8f3Ice+oMJAGYgkl1FDguAoOi6s478sGLpiV LkxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785912838; x=1786517638; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=1hVVe+2SEo04ryaB7GG9pOTNlQvAC9QD/BxdsX78cJA=; b=nItjHd2Mm5pWUKPBwXSEvDh6Mn/pC8w2kOgKMYHpUIao4I4XbX62jn9vZIGSzEszac sY85sIeVbveVMp+14UFCm5p4L+hAszwR4lH5RUMTDMohrPIHdBa4aVc51tE9/xIkbtQ9 Awi4pREC9/MHLj37jTeezDp2Jk4vCoZUBRPHfXzc+Lzo97uGf0bI+QO9+O6jgWB7eUtq THnO/hglcvyOBSM0HUgIvob5ZZ0kZI76LwX6n2BpTdtODcIhcT1v/N41eXRqNRq349CZ trP6pPnbr2f3Yk+UoCev7xzXroXTes+p7xojR9gVcM6tnsjggRlsAork9G26mNWcYopC bXMw== X-Forwarded-Encrypted: i=1; AHgh+Rq5iNiAVsX4dOcSvn7fr4G5wQuRWpXfQMfE+F++9SiX0N0oNBk8pbzWrGgzgb+ITPWAZITPjMO+qsJ+rqw=@vger.kernel.org X-Gm-Message-State: AOJu0YxGE1/lcMU8dXthUeiMBPl85JXekqX+/LevfKhQMf6pHVpiLSJY cQedhS9o6MZbZGtt4F6YQX9Q6hWmSnCBKdOmmEJaev/7G9guHVS1mcXg X-Gm-Gg: AR+sD11RFLffpj09Fm7lYep5XN+yYCnMBW1tP4RraaPxfiQMAOSUGyWmurFhS5bWA3u n0D14Ac0qdOfVXMHVspOQsqAz2Nk0qMXvFcWUIMDklzT9KQbnupwpR2Kn/RX6rlUSM02oPx8Boe 7zQmOm6aWWUBHlrY42tge7TAyIYvLh3cyIj9asq2+SBjF4jpNUMOwwxc5N1tYLGab7VxUDDboZC LLTUbTHxD+w9NW/PpD/KDJzQevXrCULg+9JmHYeIVI5KYnPAcgTVZ8J3bj8tAzBN6x7VvYj5arD bcd7355py6PpQTPgprWv47fNM8lS96U0G4GC6XhRCkte1VKmF1/5PMDQdl5kfdvIjwtNUE0cDlE O3FItZm9ANRXbGFkJettEkTbRUyVvHb6nW3MxUcinOYzYN5l/84JwrF2IrHX2gGNENqLjU567po fC79WA9jbnDdNLOE51tUVIMyLFPaVuH9RvfCpgLt+arXTTI1zIsB4DB5wNP+9UJen/JDhxGoCLe 0ZLXbdHbMpssdfzwmGZrlc= X-Received: by 2002:a17:90b:3d81:b0:380:f85c:94b4 with SMTP id 98e67ed59e1d1-3903c543020mr4931768a91.7.1785912838292; Tue, 04 Aug 2026 23:53:58 -0700 (PDT) Received: from localhost.localdomain ([118.112.74.185]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38fee06b438sm3604910a91.16.2026.08.04.23.53.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 23:53:57 -0700 (PDT) From: Jiayuan Liang To: lduncan@suse.com, cleech@redhat.com, michael.christie@oracle.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com Cc: open-iscsi@googlegroups.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Jiayuan Liang Subject: [PATCH] scsi: iscsi_tcp: Fix null-pointer dereference in iscsi_sw_tcp_conn_restore_callbacks Date: Wed, 5 Aug 2026 14:53:26 +0800 Message-ID: <20260805065326.1952-1-ljykernel@gmail.com> X-Mailer: git-send-email 2.47.0.windows.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit A null-pointer dereference can occur in iscsi_sw_tcp_conn_restore_callbacks() due to a race condition leading to concurrent/re-entrant invocations of iscsi_sw_tcp_release_conn(). Specifically, the re-entrancy can be triggered under the following scenario: 1. The iSCSI client initiates a logout, actively stopping the connection via: iscsi_if_stop_conn() -> iscsi_stop_conn(..., STOP_CONN_TERM) -> cancel_work_sync(&conn->cleanup_work) -> iscsi_sw_tcp_release_conn() 2. Simultaneously, a server disconnect triggers a heartbeat timeout on the client side, executing the timeout path: iscsi_check_transport_timeouts() -> iscsi_conn_failure() -> iscsi_conn_error_event() -> queue_work(..., &conn->cleanup_work) This schedules iscsi_cleanup_conn_work_fn(), which calls: iscsi_cleanup_conn_work_fn() -> iscsi_stop_conn(..., STOP_CONN_RECOVER) -> iscsi_sw_tcp_release_conn() If these two paths execute concurrently, iscsi_sw_tcp_release_conn() is re-entered. Since the first invocation releases the socket and sets tcp_sw_conn->sock to NULL, the subsequent re-entrant invocation in iscsi_sw_tcp_conn_restore_callbacks() attempts to dereference the NULL pointer at `tcp_sw_conn->sock->sk`, resulting in a kernel panic (Oops): BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 Oops: 0000 [#1] SMP PTI Workqueue: iscsi_conn_cleanup iscsi_cleanup_conn_work_fn [scsi_transport_iscsi] RIP: 0010:iscsi_sw_tcp_release_conn+0x54/0x110 [iscsi_tcp] Call Trace: iscsi_sw_tcp_conn_stop+0x5d/0x80 [iscsi_tcp] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_cleanup_conn_work_fn+0x6e/0xb0 [scsi_transport_iscsi] process_one_work+0x1a7/0x360 worker_thread+0x30/0x390 kthread+0x10a/0x120 ret_from_fork+0x35/0x40 Fix this by adding a NULL check for `tcp_sw_conn->sock` in iscsi_sw_tcp_conn_restore_callbacks() before attempting to access the socket's internal fields. Signed-off-by: Jiayuan Liang --- drivers/scsi/iscsi_tcp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c index 9260b1c9b0e0..0eabb8b59f46 100644 --- a/drivers/scsi/iscsi_tcp.c +++ b/drivers/scsi/iscsi_tcp.c @@ -265,8 +265,12 @@ iscsi_sw_tcp_conn_restore_callbacks(struct iscsi_conn *conn) { struct iscsi_tcp_conn *tcp_conn = conn->dd_data; struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; - struct sock *sk = tcp_sw_conn->sock->sk; + struct sock *sk; + if (!tcp_sw_conn->sock) + return; + + sk = tcp_sw_conn->sock->sk; /* restore socket callbacks, see also: iscsi_sw_tcp_conn_set_callbacks() */ write_lock_bh(&sk->sk_callback_lock); sk->sk_user_data = NULL; @@ -277,6 +281,7 @@ iscsi_sw_tcp_conn_restore_callbacks(struct iscsi_conn *conn) write_unlock_bh(&sk->sk_callback_lock); } + /** * iscsi_sw_tcp_xmit_segment - transmit segment * @tcp_conn: the iSCSI TCP connection -- 2.43.0