Re: iscsi target: Set conn->sess to NULL when iscsi_login_set_conn_values fails

[Vincent Pelletier]

On Wed, 15 Aug 2018 10:19:14 +0000, Vincent Pelletier
<plr.vinc...@gmail.com> wrote:
> Fixes a use-after-free reported by KASAN when later
> iscsi_target_login_sess_out gets called and it tries to access
> conn->sess->se_sess:

I could still hit this issue by causing a timeout, and located the
guilty kfree:

>       ret = iscsi_login_set_conn_values(sess, conn, pdu->cid);

Here, conn->sess is set.

> -     if (unlikely(ret)) {
> -             kfree(sess);

This is the guilty kfree.

> +             ret = -ENOMEM;

This is just to be strictly compliant with the hardcoded return value
which I'm replacing with "ret". I tend to think this is wrong (hiding
a possibly more relevant error code ?), but I do not know the
surrounding code nearly enough to make a decision - so status-quo it is.

Regards,
-- 
Vincent Pelletier