lkml.org 
[lkml]   [2014]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.11 133/182] iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug
    Date
    3.11.10.9 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Nicholas Bellinger <nab@linux-iscsi.org>

    commit d444edc679e7713412f243b792b1f964e5cff1e1 upstream.

    This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()
    where during ERL=2 connection recovery, a bogus conn_p pointer could
    end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION
    notifying the initiator that cmd->logout_cid has failed.

    The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with
    a bogus conn_p pointer in iscsit_build_conn_drop_async_message().

    Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com>
    Reported-by: santosh kulkarni <santosh.kulkarni@calsoftinc.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    drivers/target/iscsi/iscsi_target.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
    index 17229ff..173094a 100644
    --- a/drivers/target/iscsi/iscsi_target.c
    +++ b/drivers/target/iscsi/iscsi_target.c
    @@ -2488,6 +2488,7 @@ static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn)
    {
    struct iscsi_cmd *cmd;
    struct iscsi_conn *conn_p;
    + bool found = false;

    /*
    * Only send a Asynchronous Message on connections whos network
    @@ -2496,11 +2497,12 @@ static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn)
    list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) {
    if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) {
    iscsit_inc_conn_usage_count(conn_p);
    + found = true;
    break;
    }
    }

    - if (!conn_p)
    + if (!found)
    return;

    cmd = iscsit_allocate_cmd(conn_p, GFP_ATOMIC);
    --
    1.9.1


    \
     
     \ /
      Last update: 2014-04-26 16:41    [W:4.025 / U:0.804 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site