From: Dmitry Bogdanov <d.bogdanov@yadro.com>
To: Martin Petersen <martin.petersen@oracle.com>,
<target-devel@vger.kernel.org>
Cc: Forza <forza@tnonline.net>, <linux-scsi@vger.kernel.org>,
<linux@yadro.com>, Dmitry Bogdanov <d.bogdanov@yadro.com>
Subject: [PATCH 1/2] target: iscs: reject cmd in closed session
Date: Wed, 25 Jan 2023 11:33:08 +0300 [thread overview]
Message-ID: <20230125083309.24678-2-d.bogdanov@yadro.com> (raw)
In-Reply-To: <20230125083309.24678-1-d.bogdanov@yadro.com>
Do not handle incoming commands if the session is already closed.
That patch fixes the following stacktrace:
Decremented iSCSI connection count to 0 from node: iqn.1996-04.com.local:3
TARGET_CORE[iSCSI]: Deregistered fabric_sess
Moving to TARG_SESS_STATE_FREE.
Released iSCSI session from node: iqn.1996-04.com.local:3
Decremented number of active iSCSI Sessions on iSCSI TPG: 0 to 1
rx_loop: 48, total_rx: 48, data: 48
Got SCSI Command, ITT: 0x2000005d, CmdSN: 0x4a020000, ExpXferLen: 0, Length: 0, CID: 0
BUG: Kernel NULL pointer dereference on read at 0x00000000
Faulting instruction address: 0xc008000000a9b574
Oops: Kernel access of bad area, sig: 11 [#1]
NIP [c008000000a9b574] transport_lookup_cmd_lun+0x37c/0x470 [target_core_mod]
LR [c008000001017318] iscsit_setup_scsi_cmd+0x520/0x780 [iscsi_target_mod]
Call Trace:
[c000000059e4fae0] [c000000059e4fb70] 0xc000000059e4fb70 (unreliable)
[c000000059e4fb70] [c008000001017318] iscsit_setup_scsi_cmd+0x520/0x780 [iscsi_target_mod]
[c000000059e4fc30] [c00800000101c448] iscsit_get_rx_pdu+0x720/0x11d0 [iscsi_target_mod]
[c000000059e4fd60] [c00800000101ebc8] iscsi_target_rx_thread+0xb0/0x190 [iscsi_target_mod]
[c000000059e4fdb0] [c00000000018c50c] kthread+0x19c/0x1b0
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
---
drivers/target/iscsi/iscsi_target.c | 8 ++++++--
include/scsi/iscsi_proto.h | 1 +
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index baf4da7bb3b4..f6008675dd3f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1199,7 +1199,9 @@ int iscsit_setup_scsi_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd,
hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length,
conn->cid);
- target_get_sess_cmd(&cmd->se_cmd, true);
+ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
+ return iscsit_add_reject_cmd(cmd,
+ ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
cmd->se_cmd.tag = (__force u32)cmd->init_task_tag;
cmd->sense_reason = target_cmd_init_cdb(&cmd->se_cmd, cdb,
@@ -2057,7 +2059,9 @@ iscsit_handle_task_mgt_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd,
TCM_SIMPLE_TAG, cmd->sense_buffer + 2,
scsilun_to_int(&hdr->lun));
- target_get_sess_cmd(&cmd->se_cmd, true);
+ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
+ return iscsit_add_reject_cmd(cmd,
+ ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
/*
* TASK_REASSIGN for ERL=2 / connection stays inside of
diff --git a/include/scsi/iscsi_proto.h b/include/scsi/iscsi_proto.h
index 7b192d88f186..e3c016b013de 100644
--- a/include/scsi/iscsi_proto.h
+++ b/include/scsi/iscsi_proto.h
@@ -627,6 +627,7 @@ struct iscsi_reject {
#define ISCSI_REASON_BOOKMARK_INVALID 9
#define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10
#define ISCSI_REASON_NEGOTIATION_RESET 11
+#define ISCSI_REASON_WAITING_FOR_LOGOUT 12
/* Max. number of Key=Value pairs in a text message */
#define MAX_KEY_VALUE_PAIRS 8192
--
2.25.1
next prev parent reply other threads:[~2023-01-25 8:33 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-25 8:33 [PATCH 0/2] fix iscsi commands when session is freed Dmitry Bogdanov
2023-01-25 8:33 ` Dmitry Bogdanov [this message]
2023-01-25 17:03 ` [PATCH 1/2] target: iscs: reject cmd in closed session Mike Christie
2023-01-25 17:18 ` michael.christie
2023-01-25 20:50 ` Dmitry Bogdanov
2023-01-25 8:33 ` [PATCH 2/2] target: iscsi: free cmds before session free Dmitry Bogdanov
2023-02-11 8:42 ` Forza
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230125083309.24678-2-d.bogdanov@yadro.com \
--to=d.bogdanov@yadro.com \
--cc=forza@tnonline.net \
--cc=linux-scsi@vger.kernel.org \
--cc=linux@yadro.com \
--cc=martin.petersen@oracle.com \
--cc=target-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.