* [PATCH] scsi: target: iscsi: Fix race in discovery auth updates
@ 2026-08-11 12:48 Linfeng Sun
0 siblings, 0 replies; only message in thread
From: Linfeng Sun @ 2026-08-11 12:48 UTC (permalink / raw)
To: Martin K . Petersen, Alok Tiwari, Mike Christie
Cc: linux-scsi, target-devel, linux-kernel, Linfeng Sun
Separate configfs opens can concurrently update the discovery AuthMethod
parameter. Both callers may free the same value in
iscsi_update_param_value(), causing a double-free.
Protect the lookup and replacement with the discovery TPG access lock, as
used by the other TPG configfs parameter updates.
I dont consider this a high-severity security bug, but for safety as a
precaution, I can provide the reproducer PoC privately to the maintainers
if needed.
[ 53.935693] ==================================================================
[ 53.936125] BUG: KASAN: double-free in iscsi_update_param_value+0x41/0x140 [iscsi_target_mod]
[ 53.936725] Free of addr ffff888012e355b0 by task a.out/319
[ 53.937027]
[ 53.937120] CPU: 6 UID: 0 PID: 319 Comm: a.out Not tainted 7.2.0-rc7+ #3 PREEMPT(full)
[ 53.937130] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 53.937136] Call Trace:
[ 53.937139] <TASK>
[ 53.937142] dump_stack_lvl+0xd0/0x110
[ 53.937151] print_report+0xd1/0x630
[ 53.937161] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 53.937173] ? kasan_complete_mode_report_info+0x6a/0x210
[ 53.937182] ? iscsi_update_param_value+0x41/0x140 [iscsi_target_mod]
[ 53.937327] kasan_report_invalid_free+0xa0/0xd0
[ 53.937337] ? iscsi_update_param_value+0x41/0x140 [iscsi_target_mod]
[ 53.937484] ? iscsi_update_param_value+0x41/0x140 [iscsi_target_mod]
[ 53.937632] check_slab_allocation+0xee/0x120
[ 53.937641] __kasan_slab_pre_free+0x24/0x50
[ 53.937650] kfree+0x170/0x480
[ 53.937657] ? __pfx_kstrtouint+0x10/0x10
[ 53.937665] ? iscsi_update_param_value+0x41/0x140 [iscsi_target_mod]
[ 53.937813] iscsi_update_param_value+0x41/0x140 [iscsi_target_mod]
[ 53.937959] iscsi_disc_enforce_discovery_auth_store+0x18f/0x450 [iscsi_target_mod]
[ 53.938111] ? __pfx_iscsi_disc_enforce_discovery_auth_store+0x10/0x10 [iscsi_target_mod]
[ 53.938263] ? __kmalloc_cache_noprof+0x1be/0x460
[ 53.938272] ? configfs_write_iter+0x3fe/0x560
[ 53.938284] ? __pfx_iscsi_disc_enforce_discovery_auth_store+0x10/0x10 [iscsi_target_mod]
[ 53.938435] configfs_write_iter+0x312/0x560
[ 53.938447] ? __sanitizer_cov_trace_const_cmp4+0x16/0x30
[ 53.938458] vfs_write+0x71c/0xe60
[ 53.938464] ? __pfx_configfs_write_iter+0x10/0x10
[ 53.938477] ? __pfx_vfs_write+0x10/0x10
[ 53.938484] ? __pfx_mutex_lock+0x10/0x10
[ 53.938493] ? fdget_pos+0x213/0x5d0
[ 53.938505] ksys_write+0x154/0x290
[ 53.938512] ? __pfx_ksys_write+0x10/0x10
[ 53.938519] ? fpregs_assert_state_consistent+0xe1/0x160
[ 53.938532] ? do_syscall_64+0x13f/0x640
[ 53.938539] ? __sanitizer_cov_trace_cmp4+0x16/0x30
[ 53.938549] __x64_sys_write+0x77/0xc0
[ 53.938555] ? prandom_u32_state+0x13/0x180
[ 53.938567] x64_sys_call+0x259/0x26e0
[ 53.938579] do_syscall_64+0xf3/0x640
[ 53.938585] ? do_syscall_64+0xa8/0x640
[ 53.938592] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 53.938601] RIP: 0033:0x7e9dc22449ee
[ 53.938607] Code: 08 0f 85 f5 4b ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 53.938615] RSP: 002b:00007e9dc19a4e08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 53.938623] RAX: ffffffffffffffda RBX: 00007e9dc19a56c0 RCX: 00007e9dc22449ee
[ 53.938628] RDX: 0000000000000002 RSI: 00005a09e22de04e RDI: 0000000000000004
[ 53.938633] RBP: 00007e9dc19a4e90 R08: 0000000000000000 R09: 0000000000000000
[ 53.938638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000021
[ 53.938642] R13: 0000000000000000 R14: 00007ffcf2f464d0 R15: 00007e9dc11a5000
[ 53.938649] </TASK>
[ 53.938652]
[ 53.953000] Allocated by task 308:
[ 53.953189] kasan_save_stack+0x39/0x70
[ 53.953404] kasan_save_track+0x14/0x40
[ 53.953617] kasan_save_alloc_info+0x37/0x60
[ 53.953858] __kasan_kmalloc+0xc3/0xd0
[ 53.954073] __kmalloc_node_track_caller_noprof+0x24b/0x630
[ 53.954385] kstrdup+0x62/0x110
[ 53.954567] iscsi_update_param_value+0x4e/0x140 [iscsi_target_mod]
[ 53.955055] iscsit_load_discovery_tpg+0x3fc/0x6e0 [iscsi_target_mod]
[ 53.955545] 0xffffffffa0479430
[ 53.955724] do_one_initcall+0xd7/0x660
[ 53.955943] do_init_module+0x306/0x940
[ 53.956165] load_module+0x66c2/0x90f0
[ 53.956378] init_module_from_file+0x192/0x1c0
[ 53.956626] idempotent_init_module+0x274/0x8c0
[ 53.956883] __x64_sys_finit_module+0xd3/0x170
[ 53.957134] x64_sys_call+0x106d/0x26e0
[ 53.957354] do_syscall_64+0xf3/0x640
[ 53.957562] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 53.957851]
[ 53.957946] Freed by task 318:
[ 53.958122] kasan_save_stack+0x39/0x70
[ 53.958342] kasan_save_track+0x14/0x40
[ 53.958562] kasan_save_free_info+0x3b/0x60
[ 53.958802] __kasan_slab_free+0x6f/0xa0
[ 53.959034] kfree+0x23c/0x480
[ 53.959210] iscsi_update_param_value+0x41/0x140 [iscsi_target_mod]
[ 53.959678] iscsi_disc_enforce_discovery_auth_store+0x18f/0x450 [iscsi_target_mod]
[ 53.960236] configfs_write_iter+0x312/0x560
[ 53.960478] vfs_write+0x71c/0xe60
[ 53.960669] ksys_write+0x154/0x290
[ 53.960865] __x64_sys_write+0x77/0xc0
[ 53.961075] x64_sys_call+0x259/0x26e0
[ 53.961287] do_syscall_64+0xf3/0x640
[ 53.961490] entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
---
drivers/target/iscsi/iscsi_target_configfs.c | 26 ++++++++++++++------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index 704ec94383c3..e1aa0af52c65 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -1306,17 +1306,24 @@ static ssize_t iscsi_disc_enforce_discovery_auth_store(struct config_item *item,
return -EINVAL;
}
+ if (iscsit_get_tpg(discovery_tpg) < 0)
+ return -EINVAL;
+
param = iscsi_find_param_from_key(AUTHMETHOD,
discovery_tpg->param_list);
- if (!param)
- return -EINVAL;
+ if (!param) {
+ err = -EINVAL;
+ goto out;
+ }
if (op) {
/*
* Reset the AuthMethod key to CHAP.
*/
- if (iscsi_update_param_value(param, CHAP) < 0)
- return -EINVAL;
+ if (iscsi_update_param_value(param, CHAP) < 0) {
+ err = -EINVAL;
+ goto out;
+ }
discovery_tpg->tpg_attrib.authentication = 1;
iscsit_global->discovery_acl.node_auth.enforce_discovery_auth = 1;
@@ -1327,8 +1334,10 @@ static ssize_t iscsi_disc_enforce_discovery_auth_store(struct config_item *item,
/*
* Reset the AuthMethod key to CHAP,None
*/
- if (iscsi_update_param_value(param, "CHAP,None") < 0)
- return -EINVAL;
+ if (iscsi_update_param_value(param, "CHAP,None") < 0) {
+ err = -EINVAL;
+ goto out;
+ }
discovery_tpg->tpg_attrib.authentication = 0;
iscsit_global->discovery_acl.node_auth.enforce_discovery_auth = 0;
@@ -1337,7 +1346,10 @@ static ssize_t iscsi_disc_enforce_discovery_auth_store(struct config_item *item,
" Discovery TPG\n");
}
- return count;
+ err = count;
+out:
+ iscsit_put_tpg(discovery_tpg);
+ return err;
}
CONFIGFS_ATTR(iscsi_disc_, enforce_discovery_auth);
--
2.55.0
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-11 12:49 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-11 12:48 [PATCH] scsi: target: iscsi: Fix race in discovery auth updates Linfeng Sun
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®