From: "Nicholas A. Bellinger" <nab@linux-iscsi.org>
To: target-devel <target-devel@vger.kernel.org>
Cc: stable <stable@vger.kernel.org>,
Greg-KH <gregkh@linuxfoundation.org>,
Bart Van Assche <bart.vanassche@sandisk.com>,
Moshe David <mdavid@infinidat.com>
Subject: [PATCH-3.18.y 1/2] target/iscsi: Fix iSCSI task reassignment handling
Date: Thu, 16 Nov 2017 06:17:39 +0000 [thread overview]
Message-ID: <1510813060-15334-2-git-send-email-nab@linux-iscsi.org> (raw)
In-Reply-To: <1510813060-15334-1-git-send-email-nab@linux-iscsi.org>
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit 59b6986dbfcdab96a971f9663221849de79a7556 upstream.
Allocate a task management request structure for all task management
requests, including task reassignment. This change avoids that the
se_tmr->response assignment dereferences an uninitialized se_tmr
pointer.
Reported-by: Moshe David <mdavid@infinidat.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Moshe David <mdavid@infinidat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
---
drivers/target/iscsi/iscsi_target.c | 19 +++++++------------
include/target/target_core_base.h | 1 +
2 files changed, 8 insertions(+), 12 deletions(-)
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index ce844e9..801369f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1749,7 +1749,7 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
struct iscsi_tm *hdr;
int out_of_order_cmdsn = 0, ret;
bool sess_ref = false;
- u8 function;
+ u8 function, tcm_function = TMR_UNKNOWN;
hdr = (struct iscsi_tm *) buf;
hdr->flags &= ~ISCSI_FLAG_CMD_FINAL;
@@ -1795,10 +1795,6 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
* LIO-Target $FABRIC_MOD
*/
if (function != ISCSI_TM_FUNC_TASK_REASSIGN) {
-
- u8 tcm_function;
- int ret;
-
transport_init_se_cmd(&cmd->se_cmd,
&lio_target_fabric_configfs->tf_ops,
conn->sess->se_sess, 0, DMA_NONE,
@@ -1835,15 +1831,14 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
return iscsit_add_reject_cmd(cmd,
ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
}
-
- ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req,
- tcm_function, GFP_KERNEL);
- if (ret < 0)
- return iscsit_add_reject_cmd(cmd,
+ }
+ ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req, tcm_function,
+ GFP_KERNEL);
+ if (ret < 0)
+ return iscsit_add_reject_cmd(cmd,
ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
- cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req;
- }
+ cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req;
cmd->iscsi_opcode = ISCSI_OP_SCSI_TMFUNC;
cmd->i_state = ISTATE_SEND_TASKMGTRSP;
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index d1e7cb9..ab4bff0 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -231,6 +231,7 @@ enum tcm_tmreq_table {
TMR_LUN_RESET = 5,
TMR_TARGET_WARM_RESET = 6,
TMR_TARGET_COLD_RESET = 7,
+ TMR_UNKNOWN = 0xff,
};
/* fabric independent task management response values */
--
1.8.5.3
next prev parent reply other threads:[~2017-11-16 6:17 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-16 6:17 [PATCH-3.18.y 0/2] target: stable backports Nicholas A. Bellinger
2017-11-16 6:17 ` Nicholas A. Bellinger [this message]
2017-11-16 6:17 ` [PATCH-3.18.y 2/2] iscsi-target: Fix iscsi_np reset hung task during parallel delete Nicholas A. Bellinger
2017-11-16 6:17 ` Nicholas A. Bellinger
2017-11-16 16:46 ` Greg-KH
2017-11-16 16:46 ` Greg-KH
2017-11-16 18:35 ` Mike Christie
2017-11-16 18:35 ` Mike Christie
2017-11-19 10:23 ` Greg-KH
2017-11-19 10:23 ` Greg-KH
2018-01-12 23:49 ` [PATCH-3.18.y 0/2] target: stable backports Nicholas A. Bellinger
2018-01-13 0:03 ` Nicholas A. Bellinger
2018-01-12 23:49 ` [PATCH-3.18.y 1/2] iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref Nicholas A. Bellinger
2018-01-13 0:03 ` Nicholas A. Bellinger
2018-01-12 23:49 ` [PATCH-3.18.y 2/2] target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK Nicholas A. Bellinger
2018-01-13 0:03 ` Nicholas A. Bellinger
2018-01-13 17:33 ` [PATCH-3.18.y 0/2] target: stable backports Greg-KH
2018-01-13 17:33 ` Greg-KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1510813060-15334-2-git-send-email-nab@linux-iscsi.org \
--to=nab@linux-iscsi.org \
--cc=bart.vanassche@sandisk.com \
--cc=gregkh@linuxfoundation.org \
--cc=mdavid@infinidat.com \
--cc=stable@vger.kernel.org \
--cc=target-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.