Re: [PATCH -next 2/2] scsi: iscsi: Fix use-after-free in iscsi_conn_release() for cleanup_work

[Mike Christie]

On 8/21/26 4:24 AM, Ye Bin wrote:
> From: Ye Bin <yebin10@ huawei. com> iscsi_conn_error_event() queues conn-
> >cleanup_work without taking a reference to the connection. If the connection's
> refcount drops to zero while the work is still pending or running,
> iscsi_conn_release()
>
>
> From: Ye Bin <yeb...@huawei.com>
>
> iscsi_conn_error_event() queues conn->cleanup_work without taking a
> reference to the connection. If the connection's refcount drops to zero
> while the work is still pending or running, iscsi_conn_release() frees
> the connection memory without canceling the work, leading to a
> use-after-free when iscsi_cleanup_conn_work_fn() later dereferences the
> freed conn struct.
>
> This can happen when a session is torn down via iscsi_remove_session(),
> which calls iscsi_iter_destroy_conn_fn() to remove and drop the final
> reference on each remaining connection. Unlike iscsi_if_destroy_conn()
> (which flushes the work) and iscsi_if_stop_conn() (which cancels or
> flushes the work), the iscsi_iter_destroy_conn_fn() path does not handle
> the pending cleanup_work before dropping the connection reference.
>
> Trigger flow:
>
> CPU 0 (error path) CPU 1 (session teardown)
> ----------------------- --------------------------
> iscsi_conn_error_event(conn)
> queue_work(cleanup_work)
> [no conn reference taken] iscsi_remove_session()
> iscsi_iter_destroy_conn_fn()
> iscsi_remove_conn(conn)
> iscsi_put_conn(conn)
> refcount == 0
> iscsi_conn_release()
> kfree(conn)
>

It's not supported to run iscsi_remove_session while there's running
connections. That code was just meant for a qla4xxx mode where it
doesn't expose connections so the conn was just used to export info
to userspace via sysfs. It's for when the driver uses
qla4xxx_sess_conn_setup to create sessions and conns in one call.

There's not real use for it so I think fix qla4xxx to remove it's conn
firs, then check for session->leadconn != NULL in
libiscsi:iscsi_session_remove().
In scsi_transport_iscsi:iscsi_remove_session you could add a BUG then
since it should never be done.