[PATCH] scsi: target: iscsi: reinstate sessions only after authentication

[Yehyeong Lee]

When an initiator starts login directly in the operational stage
(CSG=1), iscsi_target_handle_csg_one() calls
iscsi_target_check_for_existing_instances(), which performs session and
connection reinstatement, before the iscsi_conn_authenticated() gate
that follows it in the same function. The reinstatement matches purely
on values taken from the login PDU: a zero-TSIH login closes the
matching session with iscsit_stop_session(), and a non-zero-TSIH login
reinstates the named connection.

So on a target that enforces authentication, a party able to present a
target initiator's InitiatorName and ISID, both of which travel in clear
in the login PDU, can force that initiator's existing session down
without passing authentication: the teardown has already happened by the
time the gate rejects the login. The impact is on availability; the
failed login gains no access.

The CSG=0 path does not have this ordering. It reaches the same
reinstatement only from the authret == 1 case of
iscsi_target_do_authentication(), that is, after CHAP has succeeded, and
the source states that intent. __iscsi_target_login_thread() notes
before iscsi_login_zero_tsih_s1() that it waits "until after
authentication to check for session reinstatement", and before
iscsi_login_non_zero_tsih_s1() that it waits "until after authentication
to check for connection reinstatement"; the helper called from the
CSG=0 path is named iscsi_login_post_auth_non_zero_tsih().

Move the reinstatement check after the iscsi_conn_authenticated() gate
so CSG=1 follows the same order as CSG=0. Where authentication is not
required the gate is transparent and behaviour is unchanged, and
login->checked_for_existing keeps the relocated call from repeating work
already done on the CSG=0 path.

This was confirmed at runtime: on an affected kernel, an unauthenticated
login that selects CSG=1 and carries another initiator's InitiatorName
and ISID tears down that initiator's authenticated session; with this
change the login is rejected and the existing session is left intact.

Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
---
 drivers/target/iscsi/iscsi_target_nego.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index b03ed154ca34e..bddbe29da807d 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -982,9 +982,6 @@ static int iscsi_target_handle_csg_one(struct iscsit_conn *conn, struct iscsi_lo
 		if (iscsi_target_check_first_request(conn, login) < 0)
 			return -1;
 
-	if (iscsi_target_check_for_existing_instances(conn, login) < 0)
-		return -1;
-
 	ret = iscsi_encode_text_output(
 			PHASE_OPERATIONAL|PHASE_DECLARATIVE,
 			SENDER_TARGET,
@@ -1008,6 +1005,13 @@ static int iscsi_target_handle_csg_one(struct iscsit_conn *conn, struct iscsi_lo
 		return -1;
 	}
 
+	/*
+	 * Reinstatement tears down a previous login, so run it only after
+	 * authentication, as the CSG=0 path does.
+	 */
+	if (iscsi_target_check_for_existing_instances(conn, login) < 0)
+		return -1;
+
 	if (!iscsi_check_negotiated_keys(conn->param_list))
 		if ((login_req->flags & ISCSI_FLAG_LOGIN_NEXT_STAGE3) &&
 		    (login_req->flags & ISCSI_FLAG_LOGIN_TRANSIT))
-- 
2.43.0