From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0ABA5C433F5 for ; Tue, 9 Nov 2021 22:39:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E56A16105A for ; Tue, 9 Nov 2021 22:39:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345388AbhKIWm0 (ORCPT ); Tue, 9 Nov 2021 17:42:26 -0500 Received: from mail.kernel.org ([198.145.29.99]:58688 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345285AbhKIWkM (ORCPT ); Tue, 9 Nov 2021 17:40:12 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9CB6B61B2B; Tue, 9 Nov 2021 22:23:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1636496618; bh=LjySgigGEFpkpOaIZGBYUfKCdv1hq1lfUA+Da8866Sk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aMT/DaryCKmTKixklZ72pHzAySvgMBcCIk0wUvR3ZzmU7gQlnRfvfLtTZ2tDowD6y zuMSyPdZYX6YXcVJYtpqjA1QM/Ffx157Avg1dUs1cv7pI6R29yUbp+ktCkFluJRS+K I0RhlCf3vGUHfoHYpxdNHdxFCPmH6B6M1z1MYJkNU1pZVhUbRWn/TnU/2mpy9WCddK I0Umdi5Dw+dFSk3Egu7AlO6zIdUAMdP1g2KhkLWtrnJi3lX5ARgMwzyqn1a8XSgd20 wiNdeVpJPwupv+Y7OB6n37QAWS07MgOgiPDmBdM2fWXnYynte08ySRTL2fY7Bpb7nJ jy9KTVLmCqGYA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Mike Christie , "Martin K . Petersen" , Sasha Levin , nab@linux-iscsi.org, linux-scsi@vger.kernel.org, target-devel@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 18/21] scsi: target: Fix alua_tg_pt_gps_count tracking Date: Tue, 9 Nov 2021 17:23:07 -0500 Message-Id: <20211109222311.1235686-18-sashal@kernel.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20211109222311.1235686-1-sashal@kernel.org> References: <20211109222311.1235686-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mike Christie [ Upstream commit 1283c0d1a32bb924324481586b5d6e8e76f676ba ] We can't free the tg_pt_gp in core_alua_set_tg_pt_gp_id() because it's still accessed via configfs. Its release must go through the normal configfs/refcount process. The max alua_tg_pt_gps_count check should probably have been done in core_alua_allocate_tg_pt_gp(), but with the current code userspace could have created 0x0000ffff + 1 groups, but only set the id for 0x0000ffff. Then it could have deleted a group with an ID set, and then set the ID for that extra group and it would work ok. It's unlikely, but just in case this patch continues to allow that type of behavior, and just fixes the kfree() while in use bug. Link: https://lore.kernel.org/r/20210930020422.92578-4-michael.christie@oracle.com Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/target/target_core_alua.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c index e46ca968009c0..804956c712a5a 100644 --- a/drivers/target/target_core_alua.c +++ b/drivers/target/target_core_alua.c @@ -1716,7 +1716,6 @@ int core_alua_set_tg_pt_gp_id( pr_err("Maximum ALUA alua_tg_pt_gps_count:" " 0x0000ffff reached\n"); spin_unlock(&dev->t10_alua.tg_pt_gps_lock); - kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp); return -ENOSPC; } again: -- 2.33.0