Patch "scsi: iscsi: Move pool freeing" has been added to the 5.10-stable tree

[gre...@linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

scsi: iscsi: Move pool freeing

to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
scsi-iscsi-move-pool-freeing.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <sta...@vger.kernel.org> know about it.


From stable+bounces-206249-greg=kroa...@vger.kernel.org Thu Jan 8 07:46:17 2026
From: Shivani Agarwal <shivani...@broadcom.com>
Date: Wed, 7 Jan 2026 22:22:21 -0800
Subject: scsi: iscsi: Move pool freeing
To: sta...@vger.kernel.org, gre...@linuxfoundation.org
Cc: ldu...@suse.com, cle...@redhat.com, michael....@oracle.com, James.B...@HansenPartnership.com, martin....@oracle.com, open-...@googlegroups.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, ajay....@broadcom.com, alexey....@broadcom.com, vamsi-krishna...@broadcom.com, yin....@broadcom.com, tapas...@broadcom.com, Shivani Agarwal <shivani...@broadcom.com>
Message-ID: <20260108062222.6707...@broadcom.com>

From: Mike Christie <michael....@oracle.com>

[ Upstream commit a1f3486b3b095ed2259d7a1fc021a8b6e72a5365 ]

This doesn't fix any bugs, but it makes more sense to free the pool after
we have removed the session. At that time we know nothing is touching any
of the session fields, because all devices have been removed and scans are
stopped.

Link: https://lore.kernel.org/r/20210525181821.7617...@oracle.com
Reviewed-by: Lee Duncan <ldu...@suse.com>
Signed-off-by: Mike Christie <michael....@oracle.com>
Signed-off-by: Martin K. Petersen <martin....@oracle.com>
[Shivani: Modified to apply on 5.10.y]
Signed-off-by: Shivani Agarwal <shivani...@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
drivers/scsi/libiscsi.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2902,10 +2902,9 @@ void iscsi_session_teardown(struct iscsi
struct module *owner = cls_session->transport->owner;
struct Scsi_Host *shost = session->host;

- iscsi_pool_free(&session->cmdpool);
-
iscsi_remove_session(cls_session);

+ iscsi_pool_free(&session->cmdpool);
kfree(session->password);
kfree(session->password_in);
kfree(session->username);


Patches currently in stable-queue which might be from shivani...@broadcom.com are

queue-5.10/usb-xhci-move-link-chain-bit-quirk-checks-into-one-helper-function.patch
queue-5.10/crypto-af_alg-zero-initialize-memory-allocated-via-sock_kmalloc.patch
queue-5.10/rdma-core-fix-kasan-slab-use-after-free-read-in-ib_register_device-problem.patch
queue-5.10/ovl-use-buf-flexible-array-for-memcpy-destination.patch
queue-5.10/cpufreq-scmi-fix-null-ptr-deref-in-scmi_cpufreq_get_rate.patch
queue-5.10/drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snooper.patch
queue-5.10/scsi-iscsi_tcp-fix-uaf-during-logout-when-accessing-the-shost-ipaddress.patch
queue-5.10/usb-xhci-apply-the-link-chain-quirk-on-nec-isoc-endpoints.patch
queue-5.10/scsi-iscsi-move-pool-freeing.patch