[BUG] scsi: target: PR OUT CLEAR registration-list teardown races concurrent PR OUT -> UAF / double list_del

[BUG] scsi: target: PR OUT CLEAR registration-list teardown races concurrent PR OUT -> UAF / double list_del

[Yu Zhang]

core_scsi3_emulate_pro_clear() tears down the global registration_list holding
only pr_tmpl->registration_lock, and __core_scsi3_free_registration() drops that
lock across its pr_res_holders busy-wait:

	spin_lock(&pr_tmpl->registration_lock);
	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
			&pr_tmpl->registration_list, pr_reg_list) {
		...
		__core_scsi3_free_registration(dev, pr_reg, NULL, calling_it_nexus);
		...
	}
	spin_unlock(&pr_tmpl->registration_lock);

__core_scsi3_free_registration():

	if (!list_empty(&pr_reg->pr_reg_list))
		list_del(&pr_reg->pr_reg_list);
	...
	spin_unlock(&pr_tmpl->registration_lock);
	while (atomic_read(&pr_reg->pr_res_holders) != 0)
		cpu_relax();
	...
	spin_lock(&pr_tmpl->registration_lock);
	...
	kmem_cache_free(t10_pr_reg_cache, pr_reg);

Unlike PR OUT PREEMPT (core_scsi3_pro_preempt), which holds
dev->dev_reservation_lock across its entire registration_list free loop, CLEAR
drops dev_reservation_lock before the loop. The same registration_lock-only
teardown appears in core_scsi3_free_pr_reg_from_nacl() and the PR OUT REGISTER
unregister path. PR OUT has no device-level serialization, so two I_T nexuses
can run teardown loops concurrently.

list_for_each_entry_safe() caches the next entry. While one CLEAR is parked in
__core_scsi3_free_registration()'s registration_lock drop, a second concurrent
CLEAR acquires registration_lock and list_del()s + kmem_cache_free()s exactly
that cached next entry. The first CLEAR then advances onto the freed entry ->
use-after-free read of ->pr_reg_list.next, list_del() on a poisoned node, and a
double kmem_cache_free().

Reproduced on a KASAN kernel with two tcm_loop I_T nexuses mapped to one iblock
LUN, each looping { PR OUT REGISTER own-key ; PR OUT CLEAR own-key } via SG_IO:

	list_del corruption, ffff...->next is LIST_POISON1 (dead000000000100)
	kernel BUG at lib/list_debug.c:56!
	RIP: __list_del_entry_valid_or_report+0xc2/0x140
	Call Trace:
	 __core_scsi3_free_registration+0x12d/0x430
	 target_scsi3_emulate_pr_out+0xac0/0x13f0
	 __target_execute_cmd+0x56/0x140
	 target_execute_cmd+0x1a0/0x5b0
	 tcm_loop_write_pending+0x15/0x20
	 transport_generic_new_cmd+0x40b/0x700
	 __target_submit+0xae/0x1e0
	 target_queued_submit_work+0x64/0x190

Note for a fix: simply taking dev_reservation_lock across the CLEAR teardown
loop (mirroring PREEMPT) is not sufficient -- it deadlocks. A PR OUT command
takes a pr_res_holders reference on its own registration via
core_scsi3_locate_pr_reg() *before* acquiring dev_reservation_lock, so one CLEAR
busy-waiting in __core_scsi3_free_registration() for another nexus's
registration to reach pr_res_holders == 0 waits forever on a nexus whose own PR
OUT is blocked on dev_reservation_lock (observed as an RCU stall). A correct fix
likely needs the registration lifetime reworked (drop the locate reference
before teardown, or defer the free to the last put) rather than only widening
the lock.

Reported-by: Yu Zhang <yuz08559@gmail.com>