scsi: target: iscsi: Check for existing sessions only after authentication

In the operational-negotiation path (CSG=1), iscsi_target_handle_csg_one()
calls iscsi_target_check_for_existing_instances() before
iscsi_conn_authenticated(). An initiator can therefore send a first Login
PDU with CSG=1, TSIH=0 and no CHAP exchange, carrying the InitiatorName and
ISID of an existing session. The target reinstates that session, which
tears down the legitimate initiator's connection. Only afterwards does it
reject the login with AUTH_FAILED.

iscsi_check_for_session_reinstatement() matches on ISID, InitiatorName and
SessionType only. The InitiatorName is not secret, and open-iscsi ISIDs are
a fixed OUI followed by a small session counter. A remote peer with no
credentials can thus repeatedly disconnect a CHAP-authenticated session and
keep its I/O failing.

The comment above iscsi_target_check_for_existing_instances() already
states the intended invariant:

  NOTE: We check for existing sessions or connections AFTER the initiator
  has been successfully authenticated in order to protect against faked
  ISID/TSIH combinations.

The security-negotiation path (CSG=0) honours this, calling the check only
once authentication completes. Move the CSG=1 call below the authentication
check so both paths behave the same. When authentication is not required,
iscsi_conn_authenticated() returns true and behaviour is unchanged.

Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Cc: stable@vger.kernel.org
Signed-off-by: Praneeth Balasubramanian <praneeth@ucsb.edu>
Link: https://patch.msgid.link/20261029205456.1211532-1-praneethb2002@gmail.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

0 files changed, 0 insertions, 0 deletions