All of
 help / color / mirror / Atom feed
From: "Nicholas A. Bellinger" <>
To: target-devel <>
Cc: linux-scsi <>,
	lkml <>,
	Rob Millner <>, Chu Yuan Lin <>,
	James Shen <>,
	Nicholas Bellinger <>
Subject: [PATCH 0/2] target: Bug-fixes for v4.11-rc
Date: Thu, 30 Mar 2017 08:29:52 +0000	[thread overview]
Message-ID: <> (raw)

From: Nicholas Bellinger <>

Hi all,

Here are two additional target bug-fixes that have been found
by the DATERA Q/A + automation team during extended longevity
and stress testing atop v4.1.y stable code.

The first is a iscsi-target specific TMR reference leak during
session shutdown when se_cmd quiesce occured before hand-off
back to iscsi-target, that results in se_tmr_req descriptors
being left after se_cmd was freed.

This would manifest as kernel paging OOPsen during LUN_RESET
after the leak occured, because the associated se_tmr_req had
not been released even though the pre-allocated parent se_cmd
descriptor had already been freed during session shutdown.

The second is a race between se_lun configfs unlink shutdown
when se_lun->lun_ref percpu_ref RCU grace period is happening,
and user-space attempts to add a new NodeACL mappedlun configfs
symlink while se_lun shutdown is occuring.

This would manifest as NULL pointer dereference OOPsen within
target_stat_scsi_att_intr_port_show_attr_dev() after a new
NodeACL mappedlun was added to a se_lun that had already
been shutdown.

Both have been verified on v4.1.y stable code, and forward
ported to v4.11-rc.

Please review.


Nicholas Bellinger (2):
  iscsi-target: Fix TMR reference leak during session shutdown
  target: Avoid mappedlun symlink creation during lun shutdown

 drivers/target/iscsi/iscsi_target_util.c     | 12 +++++++-----
 drivers/target/target_core_fabric_configfs.c |  5 +++++
 drivers/target/target_core_tpg.c             |  4 ++++
 include/target/target_core_base.h            |  1 +
 4 files changed, 17 insertions(+), 5 deletions(-)


             reply	other threads:[~2017-03-30  8:30 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-30  8:29 Nicholas A. Bellinger [this message]
2017-03-30  8:29 ` [PATCH 1/2] iscsi-target: Fix TMR reference leak during session shutdown Nicholas A. Bellinger
2017-03-30 17:08   ` Bart Van Assche
2017-04-02 22:38     ` Nicholas A. Bellinger
2017-03-30  8:29 ` [PATCH 2/2] target: Avoid mappedlun symlink creation during lun shutdown Nicholas A. Bellinger

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.