averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-04-24 10:49:54 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
4fdc19e4fa238e4a12983c54dc1d0d201a00dc18
linux-stable-mirror/drivers/scsi
T
History
Mike Christie 0aaabdb900 scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress 
[ Upstream commit f484a794e4 ]

If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,
userspace could be accessing the host's ipaddress attr. If we then free the
session via iscsi_session_teardown() while userspace is still accessing the
session we will hit a use after free bug.

Set the tcp_sw_host->session after we have completed session creation and
can no longer fail.

Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Acked-by: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-09 11:26:39 +01:00
..
aacraid
…
aic7xxx
…
aic94xx
…
arcmsr
…
arm
scsi: acornscsi: Remove scsi_cmd_to_tag() reference
2021-10-04 21:54:18 -04:00
be2iscsi
scsi: iscsi: Fix session removal on shutdown
2022-08-17 14:23:45 +02:00
bfa
scsi: bfa: Replace snprintf() with sysfs_emit()
2022-04-13 20:59:02 +02:00
bnx2fc
scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
2022-02-08 18:34:11 +01:00
bnx2i
scsi: iscsi: Fix session removal on shutdown
2022-08-17 14:23:45 +02:00
csiostor
scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
2021-11-18 19:16:52 +01:00
cxgbi
scsi: iscsi: Rename iscsi_conn_queue_work()
2022-10-26 12:35:15 +02:00
cxlflash
Merge tag 'pci-v5.15-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci
2021-09-07 19:13:42 -07:00
device_handler
scsi: scsi_dh_alua: Properly handle the ALUA transitioning state
2022-05-25 09:57:34 +02:00
dpt
…
elx
scsi: elx: libefc: Fix second parameter type in state callbacks
2022-12-31 13:14:44 +01:00
esas2r
…
fcoe
scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
2022-12-31 13:14:25 +01:00
fnic
scsi: fnic: Fix a tracing statement
2022-04-08 14:23:33 +02:00
hisi_sas
scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
2023-02-01 08:27:18 +01:00
ibmvscsi
scsi: ibmvfc: Avoid path failures during live migration
2022-12-02 17:41:02 +01:00
ibmvscsi_tgt
scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
2022-04-20 09:34:15 +02:00
isci
…
libfc
scsi: libfc: Fix use after free in fc_exch_abts_resp()
2022-04-13 20:59:08 +02:00
libsas
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
2022-10-26 12:35:15 +02:00
lpfc
scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs
2022-12-31 13:14:43 +01:00
megaraid
scsi: megaraid_sas: Fix double kfree()
2022-09-15 11:30:00 +02:00
mpi3mr
scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile
2023-01-18 11:48:53 +01:00
mpt3sas
scsi: mpt3sas: Remove scsi_dma_map() error messages
2023-01-18 11:48:58 +01:00
mvsas
scsi: mvsas: Add PCI ID of RocketRaid 2640
2022-04-20 09:34:17 +02:00
pcmcia
…
pm8001
scsi: pm80xx: Enable upper inbound, outbound queues
2022-04-20 09:34:11 +02:00
qedf
scsi: qedf: Populate sysfs attributes for vport
2022-10-26 12:34:26 +02:00
qedi
scsi: iscsi: Fix session removal on shutdown
2022-08-17 14:23:45 +02:00
qla2xxx
scsi: qla2xxx: Fix crash when I/O abort times out
2022-12-31 13:14:47 +01:00
qla4xxx
…
smartpqi
scsi: smartpqi: Fix DMA direction for RAID requests
2022-08-17 14:23:51 +02:00
snic
scsi: snic: Fix possible UAF in snic_tgt_create()
2022-12-31 13:14:25 +01:00
sym53c8xx_2
…
ufs
scsi: ufs: core: Fix devfreq deadlocks
2023-02-01 08:27:26 +01:00
.gitignore
…
3w-9xxx.c
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
2022-10-26 12:35:46 +02:00
3w-9xxx.h
…
3w-sas.c
…
3w-sas.h
…
3w-xxxx.c
…
3w-xxxx.h
…
53c700_d.h_shipped
…
53c700.c
…
53c700.h
…
53c700.scr
…
a100u2w.c
…
a100u2w.h
…
a2091.c
…
a2091.h
…
a3000.c
…
a3000.h
…
a4000t.c
…
advansys.c
scsi: advansys: Fix kernel pointer leak
2021-11-25 09:48:27 +01:00
aha152x.c
scsi: aha152x: Fix aha152x_setup() __setup handler return value
2022-04-13 20:59:07 +02:00
aha152x.h
…
aha1542.c
…
aha1542.h
…
aha1740.c
…
aha1740.h
…
am53c974.c
…
atari_scsi.c
…
atp870u.c
…
atp870u.h
…
BusLogic.c
…
BusLogic.h
…
bvme6000_scsi.c
…
ch.c
…
constants.c
…
dc395x.c
scsi: dc395x: Fix a missing check on list iterator
2022-06-09 10:23:22 +02:00
dc395x.h
…
dmx3191d.c
…
dpt_i2o.c
…
dpti.h
…
esp_scsi.c
…
esp_scsi.h
…
fdomain_isa.c
…
fdomain_pci.c
…
fdomain.c
…
fdomain.h
…
FlashPoint.c
…
g_NCR5380.c
…
gvp11.c
…
gvp11.h
…
hosts.c
scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run
2021-11-18 19:15:51 +01:00
hpsa_cmd.h
…
hpsa.c
scsi: hpsa: Fix allocation size for scsi_host_alloc()
2023-02-01 08:27:22 +01:00
hpsa.h
…
hptiop.c
…
hptiop.h
…
imm.c
…
imm.h
…
initio.c
…
initio.h
…
ipr.c
scsi: ipr: Fix WARNING in ipr_init()
2022-12-31 13:14:25 +01:00
ipr.h
…
ips.c
…
ips.h
…
iscsi_boot_sysfs.c
…
iscsi_tcp.c
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
2023-02-09 11:26:39 +01:00
iscsi_tcp.h
scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
2022-10-26 12:35:16 +02:00
jazz_esp.c
…
Kconfig
…
lasi700.c
parisc: Make struct parisc_driver::remove() return void
2021-08-30 10:18:25 +02:00
libiscsi_tcp.c
scsi: iscsi: Merge suspend fields
2022-04-27 14:38:56 +02:00
libiscsi.c
scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
2023-02-09 11:26:39 +01:00
mac53c94.c
…
mac53c94.h
…
mac_esp.c
…
mac_scsi.c
…
Makefile
scsi: core: Fix missing FORCE for scsi_devinfo_tbl.c build rule
2021-08-23 23:07:05 -04:00
megaraid.c
scsi: megaraid: Fix error check return value of register_chrdev()
2022-06-09 10:22:34 +02:00
megaraid.h
…
mesh.c
…
mesh.h
…
mvme16x_scsi.c
…
mvme147.c
…
mvme147.h
…
mvumi.c
…
mvumi.h
…
myrb.c
scsi: myrb: Fix up null pointer access on myrb_cleanup()
2022-06-14 18:36:22 +02:00
myrb.h
…
myrs.c
scsi: myrs: Fix crash in error case
2022-02-16 12:56:14 +01:00
myrs.h
…
ncr53c8xx.c
scsi: ncr53c8xx: Remove unused retrieve_from_waiting_list() function
2021-09-13 22:15:47 -04:00
ncr53c8xx.h
…
NCR5380.c
…
NCR5380.h
…
nsp32_debug.c
…
nsp32_io.h
…
nsp32.c
…
nsp32.h
…
pmcraid.c
scsi: pmcraid: Fix missing resource cleanup in error case
2022-06-22 14:21:57 +02:00
pmcraid.h
…
ppa.c
…
ppa.h
…
ps3rom.c
…
qla1280.c
scsi: qla1280: Stop using scsi_cmnd.tag
2021-08-23 23:06:56 -04:00
qla1280.h
…
qlogicfas408.c
…
qlogicfas408.h
…
qlogicfas.c
…
qlogicpti.c
…
qlogicpti.h
…
raid_class.c
…
script_asm.pl
…
scsi_bsg.c
…
scsi_common.c
…
scsi_debug.c
scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
2022-12-31 13:14:25 +01:00
scsi_debugfs.c
scsi: core: Show SCMD_LAST in text form
2022-01-27 11:05:22 +01:00
scsi_debugfs.h
…
scsi_devinfo.c
…
scsi_dh.c
…
scsi_error.c
scsi: core: Fix a race between scsi_done() and scsi_timeout()
2022-12-31 13:14:21 +01:00
scsi_ioctl.c
scsi: core: Fix warning in scsi_alloc_sgtables()
2022-08-03 12:03:47 +02:00
scsi_lib_dma.c
…
scsi_lib.c
scsi: core: Fix scsi_mode_sense() buffer length handling
2021-11-25 09:48:26 +01:00
scsi_logging.c
…
scsi_logging.h
…
scsi_netlink.c
…
scsi_pm.c
scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()
2022-01-27 11:04:15 +01:00
scsi_priv.h
…
scsi_proc.c
…
scsi_sas_internal.h
…
scsi_scan.c
scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
2023-02-09 11:26:34 +01:00
scsi_sysctl.c
…
scsi_sysfs.c
scsi: core: Restrict legal sdev_state transitions via sysfs
2022-11-10 18:15:34 +01:00
scsi_trace.c
…
scsi_transport_api.h
…
scsi_transport_fc.c
scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters
2022-04-08 14:22:54 +02:00
scsi_transport_iscsi.c
scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace
2023-02-01 08:27:16 +01:00
scsi_transport_sas.c
scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
2022-11-26 09:24:35 +01:00
scsi_transport_spi.c
…
scsi_transport_srp.c
…
scsi.c
scsi: core: Fix scsi_device_max_queue_depth()
2022-01-27 11:04:10 +01:00
scsi.h
…
scsicam.c
…
sd_dif.c
…
sd_zbc.c
scsi: sd_zbc: Support disks with more than 2**32 logical blocks
2021-09-21 23:52:55 -04:00
sd.c
scsi: sd: Revert "scsi: sd: Remove a local variable"
2022-11-03 23:59:20 +09:00
sd.h
…
sense_codes.h
…
ses.c
scsi: ses: Fix unsigned comparison with less than zero
2021-09-28 22:42:06 -04:00
sg.c
scsi: sg: Allow waiting for commands to complete on removed device
2022-08-17 14:22:55 +02:00
sgiwd93.c
…
sim710.c
…
sni_53c710.c
…
sr_ioctl.c
scsi: sr: Do not leak information in ioctl
2022-04-27 14:38:58 +02:00
sr_vendor.c
scsi: sr: Don't use GFP_DMA
2022-01-27 11:05:03 +01:00
sr.c
scsi: sr: Fix typo in CDROM(CLOSETRAY|EJECT) handling
2022-04-13 20:59:15 +02:00
sr.h
…
st_options.h
…
st.c
block: drop unused includes in <linux/genhd.h>
2022-03-16 14:23:46 +01:00
st.h
st: do not allocate a gendisk
2021-08-23 12:54:30 -06:00
stex.c
scsi: stex: Properly zero out the passthrough command structure
2022-10-15 07:59:01 +02:00
storvsc_drv.c
scsi: storvsc: Fix handling of srb_status and capacity change events
2022-12-02 17:41:03 +01:00
sun3_scsi_vme.c
…
sun3_scsi.c
…
sun3x_esp.c
…
sun_esp.c
…
virtio_scsi.c
scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
2021-09-28 22:47:28 -04:00
vmw_pvscsi.c
scsi: vmw_pvscsi: Set residual data length conditionally
2022-01-05 12:42:39 +01:00
vmw_pvscsi.h
scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
2022-06-22 14:21:57 +02:00
wd33c93.c
…
wd33c93.h
…
wd719x.c
…
wd719x.h
…
xen-scsifront.c
xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
2022-03-11 12:22:36 +01:00
zalon.c
parisc: Make struct parisc_driver::remove() return void
2021-08-30 10:18:25 +02:00
zorro7xx.c
scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
2022-04-13 20:59:15 +02:00
zorro_esp.c
…