[PATCH v2 0/3] scsi:iscsi: handle iscsi_cls_conn device with sysfs

[PATCH v2 0/3] scsi:iscsi: handle iscsi_cls_conn device with sysfs

[Wenchao Hao]

We found a NULL pointer dereference in iscsi_sw_tcp_conn_get_param(),
the root reason is we did sysfs addition wrong.

iscsi_create_conn() expose iscsi_cls_conn to sysfs while the related
resources are not initialized. So we should delay the calling of
device_add() until these resources has been initialized.

This patchset solve this issue by correct the add and teardown flow
of iscsi_cls_conn.

-----------
V2:
  add two more iscsi_free_conn() and iscsi_remove_conn() than V1
  change the teardown flow of iscsi_cls_conn

Wenchao Hao (3):
  scsi: iscsi: Add helper functions to manage iscsi_cls_conn
  scsi:libiscsi: Add iscsi_cls_conn to sysfs after been initialized
  scsi:libiscsi: teardown iscsi_cls_conn gracefully

 drivers/scsi/libiscsi.c             | 21 ++++++---
 drivers/scsi/scsi_transport_iscsi.c | 72 +++++++++++++++++++++--------
 include/scsi/scsi_transport_iscsi.h |  5 +-
 3 files changed, 71 insertions(+), 27 deletions(-)

-- 
2.32.0

[PATCH v2 1/3] scsi: iscsi: Add helper functions to manage iscsi_cls_conn

[Wenchao Hao]

iscsi_alloc_conn(): alloc and initialize iscsi_cls_conn
iscsi_add_conn(): expose iscsi_cls_conn to userspace's via sysfs.
iscsi_remove_conn(): remove iscsi_cls_conn from sysfs
iscsi_free_conn(): free iscsi_cls_conn

Signed-off-by: Wenchao Hao <haowenchao@huawei.com>
Signed-off-by: Wu Bo <wubo40@huawei.com>
---
 drivers/scsi/scsi_transport_iscsi.c | 107 ++++++++++++++++++++++++++++
 include/scsi/scsi_transport_iscsi.h |   5 ++
 2 files changed, 112 insertions(+)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 554b6f784223..8e97c6f88359 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2340,6 +2340,113 @@ void iscsi_free_session(struct iscsi_cls_session *session)
 }
 EXPORT_SYMBOL_GPL(iscsi_free_session);
 
+/**
+ * iscsi_alloc_conn - alloc iscsi class connection
+ * @session: iscsi cls session
+ * @dd_size: private driver data size
+ * @cid: connection id
+ *
+ * This can be called from a LLD or iscsi_transport. The connection
+ * is child of the session so cid must be unique for all connections
+ * on the session.
+ *
+ * Since we do not support MCS, cid will normally be zero. In some cases
+ * for software iscsi we could be trying to preallocate a connection struct
+ * in which case there could be two connection structs and cid would be
+ * non-zero.
+ */
+struct iscsi_cls_conn *
+iscsi_alloc_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
+{
+	struct iscsi_transport *transport = session->transport;
+	struct iscsi_cls_conn *conn;
+
+	conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL);
+	if (!conn)
+		return NULL;
+	if (dd_size)
+		conn->dd_data = &conn[1];
+
+	mutex_init(&conn->ep_mutex);
+	INIT_LIST_HEAD(&conn->conn_list);
+	INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn);
+	conn->transport = transport;
+	conn->cid = cid;
+	conn->state = ISCSI_CONN_DOWN;
+
+	/* this is released in the dev's release function */
+	if (!get_device(&session->dev))
+		goto free_conn;
+
+	dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid);
+	device_initialize(&conn->dev);
+	conn->dev.parent = &session->dev;
+	conn->dev.release = iscsi_conn_release;
+
+	return conn;
+
+free_conn:
+	kfree(conn);
+	return NULL;
+}
+EXPORT_SYMBOL_GPL(iscsi_alloc_conn);
+
+/**
+ * iscsi_add_conn - add iscsi class connection
+ * @conn: iscsi cls connection
+ *
+ * this would expose iscsi_cls_conn to sysfs, so make sure the related
+ * resources when access sysfs attributes are initialized before calling this.
+ */
+int iscsi_add_conn(struct iscsi_cls_conn *conn)
+{
+	int err;
+	unsigned long flags;
+	struct iscsi_cls_session *session = iscsi_dev_to_session(conn->dev.parent);
+
+	err = device_add(&conn->dev);
+	if (err) {
+		iscsi_cls_session_printk(KERN_ERR, session,
+					 "could not register connection's dev\n");
+		put_device(&session->dev);
+		return err;
+	}
+	err = transport_register_device(&conn->dev);
+	if (err) {
+		iscsi_cls_session_printk(KERN_ERR, session,
+					 "could not register transport's dev\n");
+		device_del(&conn->dev);
+		put_device(&session->dev);
+		return err;
+	}
+
+	spin_lock_irqsave(&connlock, flags);
+	list_add(&conn->conn_list, &connlist);
+	spin_unlock_irqrestore(&connlock, flags);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(iscsi_add_conn);
+
+/**
+ * iscsi_remove_conn - remove iscsi class connection from sysfs
+ * @conn: iscsi cls connection
+ *
+ * this would remove iscsi_cls_conn from sysfs, and wait for previous
+ * read/write of iscsi_cls_conn's attributes in sysfs finishing
+ */
+void iscsi_remove_conn(struct iscsi_cls_conn *conn)
+{
+	device_del(&conn->dev);
+}
+EXPORT_SYMBOL_GPL(iscsi_remove_conn);
+
+void iscsi_free_conn(struct iscsi_cls_conn *conn)
+{
+	put_device(&conn->dev);
+}
+EXPORT_SYMBOL_GPL(iscsi_free_conn);
+
 /**
  * iscsi_create_conn - create iscsi class connection
  * @session: iscsi cls session
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index c5d7810fd792..346f65bc3861 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -441,6 +441,11 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost,
 						unsigned int target_id);
 extern void iscsi_remove_session(struct iscsi_cls_session *session);
 extern void iscsi_free_session(struct iscsi_cls_session *session);
+extern struct iscsi_cls_conn *iscsi_alloc_conn(struct iscsi_cls_session *sess,
+						int dd_size, uint32_t cid);
+extern int iscsi_add_conn(struct iscsi_cls_conn *conn);
+extern void iscsi_remove_conn(struct iscsi_cls_conn *conn);
+extern void iscsi_free_conn(struct iscsi_cls_conn *conn);
 extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
 						int dd_size, uint32_t cid);
 extern void iscsi_put_conn(struct iscsi_cls_conn *conn);
-- 
2.32.0

Re: [PATCH v2 1/3] scsi: iscsi: Add helper functions to manage iscsi_cls_conn

[Mike Christie]

On 3/8/22 9:09 PM, Wenchao Hao wrote:
> iscsi_alloc_conn(): alloc and initialize iscsi_cls_conn
> iscsi_add_conn(): expose iscsi_cls_conn to userspace's via sysfs.
> iscsi_remove_conn(): remove iscsi_cls_conn from sysfs
> iscsi_free_conn(): free iscsi_cls_conn
> 
> Signed-off-by: Wenchao Hao <haowenchao@huawei.com>
> Signed-off-by: Wu Bo <wubo40@huawei.com>
> ---
>  drivers/scsi/scsi_transport_iscsi.c | 107 ++++++++++++++++++++++++++++
>  include/scsi/scsi_transport_iscsi.h |   5 ++
>  2 files changed, 112 insertions(+)
> 
> diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
> index 554b6f784223..8e97c6f88359 100644
> --- a/drivers/scsi/scsi_transport_iscsi.c
> +++ b/drivers/scsi/scsi_transport_iscsi.c
> @@ -2340,6 +2340,113 @@ void iscsi_free_session(struct iscsi_cls_session *session)
>  }
>  EXPORT_SYMBOL_GPL(iscsi_free_session);
>  
> +/**
> + * iscsi_alloc_conn - alloc iscsi class connection
> + * @session: iscsi cls session
> + * @dd_size: private driver data size
> + * @cid: connection id
> + *
> + * This can be called from a LLD or iscsi_transport. The connection
> + * is child of the session so cid must be unique for all connections
> + * on the session.
> + *
> + * Since we do not support MCS, cid will normally be zero. In some cases
> + * for software iscsi we could be trying to preallocate a connection struct
> + * in which case there could be two connection structs and cid would be
> + * non-zero.

Is that with the upstream iscsi tools or your version? I don't think the comment
is needed or is needed somewhere else.

If this happens then they will have the same sysfs/device name so when we do the
device_add it will spit an error about duplicate names.


> + */
> +struct iscsi_cls_conn *
> +iscsi_alloc_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
> +{
> +	struct iscsi_transport *transport = session->transport;
> +	struct iscsi_cls_conn *conn;
> +
> +	conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL);
> +	if (!conn)
> +		return NULL;
> +	if (dd_size)
> +		conn->dd_data = &conn[1];
> +
> +	mutex_init(&conn->ep_mutex);
> +	INIT_LIST_HEAD(&conn->conn_list);
> +	INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn);
> +	conn->transport = transport;
> +	conn->cid = cid;
> +	conn->state = ISCSI_CONN_DOWN;
> +
> +	/* this is released in the dev's release function */
> +	if (!get_device(&session->dev))
> +		goto free_conn;
> +
> +	dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid);
> +	device_initialize(&conn->dev);
> +	conn->dev.parent = &session->dev;
> +	conn->dev.release = iscsi_conn_release;
> +
> +	return conn;
> +
> +free_conn:
> +	kfree(conn);
> +	return NULL;
> +}
> +EXPORT_SYMBOL_GPL(iscsi_alloc_conn);
> +
> +/**
> + * iscsi_add_conn - add iscsi class connection
> + * @conn: iscsi cls connection
> + *
> + * this would expose iscsi_cls_conn to sysfs, so make sure the related
> + * resources when access sysfs attributes are initialized before calling this.
> + */
> +int iscsi_add_conn(struct iscsi_cls_conn *conn)
> +{
> +	int err;
> +	unsigned long flags;
> +	struct iscsi_cls_session *session = iscsi_dev_to_session(conn->dev.parent);
> +
> +	err = device_add(&conn->dev);
> +	if (err) {
> +		iscsi_cls_session_printk(KERN_ERR, session,
> +					 "could not register connection's dev\n");
> +		put_device(&session->dev);

I would call iscsi_free_conn. instead of put_device.

> +		return err;
> +	}
> +	err = transport_register_device(&conn->dev);
> +	if (err) {
> +		iscsi_cls_session_printk(KERN_ERR, session,
> +					 "could not register transport's dev\n");
> +		device_del(&conn->dev);
> +		put_device(&session->dev);


Is for the get_device(&session->dev) in iscsi_alloc_conn? If so you don't need to
do it because when the last put is done on the conn->dev, it will call
iscsi_conn_release which does the put on the session when it does "put_device(parent).

Or did you mean to call put_device on the conn->dev?

I would do device_el(&conn->dev) then do a goto free_conn at the bottom which
does iscsi_free_conn. The place above should do the goto as well.


> +		return err;
> +	}
> +
> +	spin_lock_irqsave(&connlock, flags);
> +	list_add(&conn->conn_list, &connlist);
> +	spin_unlock_irqrestore(&connlock, flags);
> +
> +	return 0;
> +}
> +EXPORT_SYMBOL_GPL(iscsi_add_conn);
> +
> +/**
> + * iscsi_remove_conn - remove iscsi class connection from sysfs
> + * @conn: iscsi cls connection
> + *
> + * this would remove iscsi_cls_conn from sysfs, and wait for previous
> + * read/write of iscsi_cls_conn's attributes in sysfs finishing
> + */
> +void iscsi_remove_conn(struct iscsi_cls_conn *conn)
> +{
> +	device_del(&conn->dev);

This should have the guts of iscsi_destroy_conn which reverses what
the iscsi_add_conn did:

        spin_lock_irqsave(&connlock, flags);
        list_del(&conn->conn_list);
        spin_unlock_irqrestore(&connlock, flags);

        transport_unregister_device(&conn->dev);

	device_del(&conn->dev).

You can then kill iscsi_destroy_conn.


> +}
> +EXPORT_SYMBOL_GPL(iscsi_remove_conn);
> +
> +void iscsi_free_conn(struct iscsi_cls_conn *conn)
> +{
> +	put_device(&conn->dev);
> +}
> +EXPORT_SYMBOL_GPL(iscsi_free_conn);

Sorry I made a mistake with this suggestion. Kill this and just have
the user do iscsi_put_conn.


> +
>  /**
>   * iscsi_create_conn - create iscsi class connection
>   * @session: iscsi cls session
> diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
> index c5d7810fd792..346f65bc3861 100644
> --- a/include/scsi/scsi_transport_iscsi.h
> +++ b/include/scsi/scsi_transport_iscsi.h
> @@ -441,6 +441,11 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost,
>  						unsigned int target_id);
>  extern void iscsi_remove_session(struct iscsi_cls_session *session);
>  extern void iscsi_free_session(struct iscsi_cls_session *session);
> +extern struct iscsi_cls_conn *iscsi_alloc_conn(struct iscsi_cls_session *sess,
> +						int dd_size, uint32_t cid);
> +extern int iscsi_add_conn(struct iscsi_cls_conn *conn);
> +extern void iscsi_remove_conn(struct iscsi_cls_conn *conn);
> +extern void iscsi_free_conn(struct iscsi_cls_conn *conn);
>  extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
>  						int dd_size, uint32_t cid);
>  extern void iscsi_put_conn(struct iscsi_cls_conn *conn);

Re: [PATCH v2 1/3] scsi: iscsi: Add helper functions to manage iscsi_cls_conn

[Wenchao Hao]

On 2022/3/9 1:19, Mike Christie wrote:
> On 3/8/22 9:09 PM, Wenchao Hao wrote:
>> iscsi_alloc_conn(): alloc and initialize iscsi_cls_conn
>> iscsi_add_conn(): expose iscsi_cls_conn to userspace's via sysfs.
>> iscsi_remove_conn(): remove iscsi_cls_conn from sysfs
>> iscsi_free_conn(): free iscsi_cls_conn
>>
>> Signed-off-by: Wenchao Hao <haowenchao@huawei.com>
>> Signed-off-by: Wu Bo <wubo40@huawei.com>
>> ---
>>   drivers/scsi/scsi_transport_iscsi.c | 107 ++++++++++++++++++++++++++++
>>   include/scsi/scsi_transport_iscsi.h |   5 ++
>>   2 files changed, 112 insertions(+)
>>
>> diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
>> index 554b6f784223..8e97c6f88359 100644
>> --- a/drivers/scsi/scsi_transport_iscsi.c
>> +++ b/drivers/scsi/scsi_transport_iscsi.c
>> @@ -2340,6 +2340,113 @@ void iscsi_free_session(struct iscsi_cls_session *session)
>>   }
>>   EXPORT_SYMBOL_GPL(iscsi_free_session);
>>   
>> +/**
>> + * iscsi_alloc_conn - alloc iscsi class connection
>> + * @session: iscsi cls session
>> + * @dd_size: private driver data size
>> + * @cid: connection id
>> + *
>> + * This can be called from a LLD or iscsi_transport. The connection
>> + * is child of the session so cid must be unique for all connections
>> + * on the session.
>> + *
>> + * Since we do not support MCS, cid will normally be zero. In some cases
>> + * for software iscsi we could be trying to preallocate a connection struct
>> + * in which case there could be two connection structs and cid would be
>> + * non-zero.
> 
> Is that with the upstream iscsi tools or your version? I don't think the comment
> is needed or is needed somewhere else.
> 
> If this happens then they will have the same sysfs/device name so when we do the
> device_add it will spit an error about duplicate names.
> 
> 
>> + */
>> +struct iscsi_cls_conn *
>> +iscsi_alloc_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
>> +{
>> +	struct iscsi_transport *transport = session->transport;
>> +	struct iscsi_cls_conn *conn;
>> +
>> +	conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL);
>> +	if (!conn)
>> +		return NULL;
>> +	if (dd_size)
>> +		conn->dd_data = &conn[1];
>> +
>> +	mutex_init(&conn->ep_mutex);
>> +	INIT_LIST_HEAD(&conn->conn_list);
>> +	INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn);
>> +	conn->transport = transport;
>> +	conn->cid = cid;
>> +	conn->state = ISCSI_CONN_DOWN;
>> +
>> +	/* this is released in the dev's release function */
>> +	if (!get_device(&session->dev))
>> +		goto free_conn;
>> +
>> +	dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid);
>> +	device_initialize(&conn->dev);
>> +	conn->dev.parent = &session->dev;
>> +	conn->dev.release = iscsi_conn_release;
>> +
>> +	return conn;
>> +
>> +free_conn:
>> +	kfree(conn);
>> +	return NULL;
>> +}
>> +EXPORT_SYMBOL_GPL(iscsi_alloc_conn);
>> +
>> +/**
>> + * iscsi_add_conn - add iscsi class connection
>> + * @conn: iscsi cls connection
>> + *
>> + * this would expose iscsi_cls_conn to sysfs, so make sure the related
>> + * resources when access sysfs attributes are initialized before calling this.
>> + */
>> +int iscsi_add_conn(struct iscsi_cls_conn *conn)
>> +{
>> +	int err;
>> +	unsigned long flags;
>> +	struct iscsi_cls_session *session = iscsi_dev_to_session(conn->dev.parent);
>> +
>> +	err = device_add(&conn->dev);
>> +	if (err) {
>> +		iscsi_cls_session_printk(KERN_ERR, session,
>> +					 "could not register connection's dev\n");
>> +		put_device(&session->dev);
> 
> I would call iscsi_free_conn. instead of put_device.
> 

Sorry I noticed it but forget to remove it. Here should not call 
put_device() or iscsi_free_conn(). If iscsi_add_conn() failed, we shoule 
not call any put operation which might cause resource free.

>> +		return err;
>> +	}
>> +	err = transport_register_device(&conn->dev);
>> +	if (err) {
>> +		iscsi_cls_session_printk(KERN_ERR, session,
>> +					 "could not register transport's dev\n");
>> +		device_del(&conn->dev);
>> +		put_device(&session->dev);
> 
> 
> Is for the get_device(&session->dev) in iscsi_alloc_conn? If so you don't need to
> do it because when the last put is done on the conn->dev, it will call
> iscsi_conn_release which does the put on the session when it does "put_device(parent).
> 
> Or did you mean to call put_device on the conn->dev?
> 

As above, we shouldn't call put_device() here.

> I would do device_el(&conn->dev) then do a goto free_conn at the bottom which
> does iscsi_free_conn. The place above should do the goto as well.
> 
> 

[PATCH v2 2/3] scsi:libiscsi: Add iscsi_cls_conn to sysfs after been initialized

[Wenchao Hao]

iscsi_create_conn() would expose iscsi_cls_conn to sysfs, while the
initialization of iscsi_conn's dd_data is not ready now. When userspace
try to access an attribute such as connect's address, it might cause
a NULL pointer dereference.

So we should add iscsi_cls_conn to sysfs until it has been initialized.

Remove iscsi_create_conn() by hand since it is not used now.

Signed-off-by: Wenchao Hao <haowenchao@huawei.com>
Signed-off-by: Wu Bo <wubo40@huawei.com>
---
 drivers/scsi/libiscsi.c             | 13 ++++-
 drivers/scsi/scsi_transport_iscsi.c | 76 -----------------------------
 include/scsi/scsi_transport_iscsi.h |  2 -
 3 files changed, 11 insertions(+), 80 deletions(-)

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 059dae8909ee..43f903bce0b8 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -3040,8 +3040,9 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
 	struct iscsi_conn *conn;
 	struct iscsi_cls_conn *cls_conn;
 	char *data;
+	int err;
 
-	cls_conn = iscsi_create_conn(cls_session, sizeof(*conn) + dd_size,
+	cls_conn = iscsi_alloc_conn(cls_session, sizeof(*conn) + dd_size,
 				     conn_idx);
 	if (!cls_conn)
 		return NULL;
@@ -3078,13 +3079,21 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
 		goto login_task_data_alloc_fail;
 	conn->login_task->data = conn->data = data;
 
+	err = iscsi_add_conn(cls_conn);
+	if (err)
+		goto login_task_add_dev_fail;
+
 	return cls_conn;
 
+login_task_add_dev_fail:
+	free_pages((unsigned long) conn->data,
+		   get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
+
 login_task_data_alloc_fail:
 	kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
 		    sizeof(void*));
 login_task_alloc_fail:
-	iscsi_destroy_conn(cls_conn);
+	iscsi_free_conn(cls_conn);
 	return NULL;
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_setup);
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 8e97c6f88359..ca724eed4f4d 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2447,82 +2447,6 @@ void iscsi_free_conn(struct iscsi_cls_conn *conn)
 }
 EXPORT_SYMBOL_GPL(iscsi_free_conn);
 
-/**
- * iscsi_create_conn - create iscsi class connection
- * @session: iscsi cls session
- * @dd_size: private driver data size
- * @cid: connection id
- *
- * This can be called from a LLD or iscsi_transport. The connection
- * is child of the session so cid must be unique for all connections
- * on the session.
- *
- * Since we do not support MCS, cid will normally be zero. In some cases
- * for software iscsi we could be trying to preallocate a connection struct
- * in which case there could be two connection structs and cid would be
- * non-zero.
- */
-struct iscsi_cls_conn *
-iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
-{
-	struct iscsi_transport *transport = session->transport;
-	struct iscsi_cls_conn *conn;
-	unsigned long flags;
-	int err;
-
-	conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL);
-	if (!conn)
-		return NULL;
-	if (dd_size)
-		conn->dd_data = &conn[1];
-
-	mutex_init(&conn->ep_mutex);
-	INIT_LIST_HEAD(&conn->conn_list);
-	INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn);
-	conn->transport = transport;
-	conn->cid = cid;
-	conn->state = ISCSI_CONN_DOWN;
-
-	/* this is released in the dev's release function */
-	if (!get_device(&session->dev))
-		goto free_conn;
-
-	dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid);
-	conn->dev.parent = &session->dev;
-	conn->dev.release = iscsi_conn_release;
-	err = device_register(&conn->dev);
-	if (err) {
-		iscsi_cls_session_printk(KERN_ERR, session, "could not "
-					 "register connection's dev\n");
-		goto release_parent_ref;
-	}
-	err = transport_register_device(&conn->dev);
-	if (err) {
-		iscsi_cls_session_printk(KERN_ERR, session, "could not "
-					 "register transport's dev\n");
-		goto release_conn_ref;
-	}
-
-	spin_lock_irqsave(&connlock, flags);
-	list_add(&conn->conn_list, &connlist);
-	spin_unlock_irqrestore(&connlock, flags);
-
-	ISCSI_DBG_TRANS_CONN(conn, "Completed conn creation\n");
-	return conn;
-
-release_conn_ref:
-	device_unregister(&conn->dev);
-	put_device(&session->dev);
-	return NULL;
-release_parent_ref:
-	put_device(&session->dev);
-free_conn:
-	kfree(conn);
-	return NULL;
-}
-
-EXPORT_SYMBOL_GPL(iscsi_create_conn);
-
 /**
  * iscsi_destroy_conn - destroy iscsi class connection
  * @conn: iscsi cls session
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 346f65bc3861..505764942f5e 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -446,8 +446,6 @@ extern struct iscsi_cls_conn *iscsi_alloc_conn(struct iscsi_cls_session *sess,
 extern int iscsi_add_conn(struct iscsi_cls_conn *conn);
 extern void iscsi_remove_conn(struct iscsi_cls_conn *conn);
 extern void iscsi_free_conn(struct iscsi_cls_conn *conn);
-extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
-						int dd_size, uint32_t cid);
 extern void iscsi_put_conn(struct iscsi_cls_conn *conn);
 extern void iscsi_get_conn(struct iscsi_cls_conn *conn);
 extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
-- 
2.32.0

[PATCH v2 3/3] scsi:libiscsi: teardown iscsi_cls_conn gracefully

[Wenchao Hao]

commit 1b8d0300a3e9 ("scsi: libiscsi: Fix UAF in
iscsi_conn_get_param()/iscsi_conn_teardown()") fixed an UAF in
iscsi_conn_get_param() and introduced 2 tmp_xxx varibles, the
implement looks ugly.

We can fix this UAF with the help of device_del() gracefully.
Call iscsi_remove_conn() at the beginning of iscsi_conn_teardown would
make userspace unable to see iscsi_cls_conn any more, then we can free
memory safely.

Signed-off-by: Wenchao Hao <haowenchao@huawei.com>
Signed-off-by: Wu Bo <wubo40@huawei.com>
---
 drivers/scsi/libiscsi.c             | 8 ++++----
 drivers/scsi/scsi_transport_iscsi.c | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 43f903bce0b8..0d57521751dd 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -3109,8 +3109,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
 {
 	struct iscsi_conn *conn = cls_conn->dd_data;
 	struct iscsi_session *session = conn->session;
-	char *tmp_persistent_address = conn->persistent_address;
-	char *tmp_local_ipaddr = conn->local_ipaddr;
+
+	iscsi_remove_conn(cls_conn);
 
 	del_timer_sync(&conn->transport_timer);
 
@@ -3132,6 +3132,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
 	spin_lock_bh(&session->frwd_lock);
 	free_pages((unsigned long) conn->data,
 		   get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
+	kfree(conn->persistent_address);
+	kfree(conn->local_ipaddr);
 	/* regular RX path uses back_lock */
 	spin_lock_bh(&session->back_lock);
 	kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
@@ -3143,8 +3145,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
 	mutex_unlock(&session->eh_mutex);
 
 	iscsi_destroy_conn(cls_conn);
-	kfree(tmp_persistent_address);
-	kfree(tmp_local_ipaddr);
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
 
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index ca724eed4f4d..7b4d998708e7 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2165,6 +2165,7 @@ static int iscsi_iter_destroy_conn_fn(struct device *dev, void *data)
 {
 	if (!iscsi_is_conn_dev(dev))
 		return 0;
+	iscsi_remove_conn(iscsi_dev_to_conn(dev));
 	return iscsi_destroy_conn(iscsi_dev_to_conn(dev));
 }
 
@@ -2463,7 +2464,7 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn)
 
 	transport_unregister_device(&conn->dev);
 	ISCSI_DBG_TRANS_CONN(conn, "Completing conn destruction\n");
-	device_unregister(&conn->dev);
+	iscsi_free_conn(conn);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(iscsi_destroy_conn);
-- 
2.32.0

Re: [PATCH v2 3/3] scsi:libiscsi: teardown iscsi_cls_conn gracefully

[Mike Christie]

On 3/8/22 9:09 PM, Wenchao Hao wrote:
> diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
> index ca724eed4f4d..7b4d998708e7 100644
> --- a/drivers/scsi/scsi_transport_iscsi.c
> +++ b/drivers/scsi/scsi_transport_iscsi.c
> @@ -2165,6 +2165,7 @@ static int iscsi_iter_destroy_conn_fn(struct device *dev, void *data)
>  {
>  	if (!iscsi_is_conn_dev(dev))
>  		return 0;
> +	iscsi_remove_conn(iscsi_dev_to_conn(dev));
>  	return iscsi_destroy_conn(iscsi_dev_to_conn(dev));

Just do:

iscsi_remove_conn
iscsi_put_conn
return 0;



>  }
>  
> @@ -2463,7 +2464,7 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn)
>  
>  	transport_unregister_device(&conn->dev);
>  	ISCSI_DBG_TRANS_CONN(conn, "Completing conn destruction\n");
> -	device_unregister(&conn->dev);
> +	iscsi_free_conn(conn);
>  	return 0;
>  }
>  EXPORT_SYMBOL_GPL(iscsi_destroy_conn);

Re: [PATCH v2 3/3] scsi:libiscsi: teardown iscsi_cls_conn gracefully

[Mike Christie]

On 3/8/22 9:09 PM, Wenchao Hao wrote:
> @@ -3143,8 +3145,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
>  	mutex_unlock(&session->eh_mutex);
>  
>  	iscsi_destroy_conn(cls_conn);

This should then be a iscsi_put_conn.

So basically it balances out.

iscsi_alloc_conn requires iscsi_put_conn. The put releases what is
done in the alloc. The put on the parent is done in the release though.

iscsi_add_conn requires iscsi_remove_conn. The remove undoes what
was done in the add

We don't want a iscsi_destroy_conn which does a iscsi_free_conn
because it makes it confusing.