AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2025-01-18 17:16:27 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
ad669505c4
linux_dsm_epyc7002/drivers/target
History
Bart Van Assche ad669505c4 scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough 
A session must only be released after all code that accesses the session
structure has finished. Make sure that this is the case by introducing a
new command counter per session that is only decremented after the
.release_cmd() callback has finished. This patch fixes the following crash:

BUG: KASAN: use-after-free in do_raw_spin_lock+0x1c/0x130
Read of size 4 at addr ffff8801534b16e4 by task rmdir/14805
CPU: 16 PID: 14805 Comm: rmdir Not tainted 4.18.0-rc2-dbg+ #5
Call Trace:
dump_stack+0xa4/0xf5
print_address_description+0x6f/0x270
kasan_report+0x241/0x360
__asan_load4+0x78/0x80
do_raw_spin_lock+0x1c/0x130
_raw_spin_lock_irqsave+0x52/0x60
srpt_set_ch_state+0x27/0x70 [ib_srpt]
srpt_disconnect_ch+0x1b/0xc0 [ib_srpt]
srpt_close_session+0xa8/0x260 [ib_srpt]
target_shutdown_sessions+0x170/0x180 [target_core_mod]
core_tpg_del_initiator_node_acl+0xf3/0x200 [target_core_mod]
target_fabric_nacl_base_release+0x25/0x30 [target_core_mod]
config_item_release+0x9c/0x110 [configfs]
config_item_put+0x26/0x30 [configfs]
configfs_rmdir+0x3b8/0x510 [configfs]
vfs_rmdir+0xb3/0x1e0
do_rmdir+0x262/0x2c0
do_syscall_64+0x77/0x230
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Mike Christie <mchristi@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: David Disseldorp <ddiss@suse.de>
Cc: Hannes Reinecke <hare@suse.de>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2018-12-07 21:20:07 -05:00
..
iscsi scsi: target: replace fabric_ops.name with fabric_alias 2018-11-28 18:50:59 -05:00
loopback scsi: target: replace fabric_ops.name with fabric_alias 2018-11-28 18:50:59 -05:00
sbp scsi: target: replace fabric_ops.name with fabric_alias 2018-11-28 18:50:59 -05:00
tcm_fc scsi: target: replace fabric_ops.name with fabric_alias 2018-11-28 18:50:59 -05:00
Kconfig target: don't depend on SCSI 2018-08-02 15:19:49 -06:00
Makefile
target_core_alua.c scsi: target: drop unnecessary get_fabric_name() accessor from fabric_ops 2018-11-28 18:50:58 -05:00
target_core_alua.h
target_core_configfs.c scsi: target: replace fabric_ops.name with fabric_alias 2018-11-28 18:50:59 -05:00
target_core_device.c scsi: target/core: Simplify transport_clear_lun_ref() 2018-12-07 21:20:07 -05:00
target_core_fabric_configfs.c scsi: target: drop unnecessary get_fabric_name() accessor from fabric_ops 2018-11-28 18:50:58 -05:00
target_core_fabric_lib.c
target_core_file.c iov_iter: Separate type from direction and use accessor functions 2018-10-24 00:41:07 +01:00
target_core_file.h scsi: target: target/file: Add support of direct and async I/O 2018-05-14 22:40:08 -04:00
target_core_hba.c
target_core_iblock.c scsi: target/core: Use the SECTOR_SHIFT constant 2018-10-16 01:13:35 -04:00
target_core_iblock.h scsi: target/core: Use the SECTOR_SHIFT constant 2018-10-16 01:13:35 -04:00
target_core_internal.h scsi: target: Fold core_tmr_handle_tas_abort() into transport_cmd_finish_abort() 2018-07-02 16:44:31 -04:00
target_core_pr.c scsi: target: drop unnecessary get_fabric_name() accessor from fabric_ops 2018-11-28 18:50:58 -05:00
target_core_pr.h
target_core_pscsi.c SCSI misc on 20180610 2018-06-10 13:01:12 -07:00
target_core_pscsi.h
target_core_rd.c
target_core_rd.h
target_core_sbc.c scsi: target/core: Always call transport_complete_callback() upon failure 2018-10-16 01:13:35 -04:00
target_core_spc.c scsi: target: add emulate_pr backstore attr to toggle PR support 2018-11-21 22:10:36 -05:00
target_core_stat.c scsi: target: drop unnecessary get_fabric_name() accessor from fabric_ops 2018-11-28 18:50:58 -05:00
target_core_tmr.c scsi: target: drop unnecessary get_fabric_name() accessor from fabric_ops 2018-11-28 18:50:58 -05:00
target_core_tpg.c scsi: target/core: Simplify transport_clear_lun_ref() 2018-12-07 21:20:07 -05:00
target_core_transport.c scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough 2018-12-07 21:20:07 -05:00
target_core_ua.c scsi: target: drop unnecessary get_fabric_name() accessor from fabric_ops 2018-11-28 18:50:58 -05:00
target_core_ua.h scsi: target: Fix handling of removed LUNs 2018-07-02 16:44:32 -04:00
target_core_user.c scsi: target/tcmu: Fix queue_cmd_ring() declaration 2018-12-07 21:20:07 -05:00
target_core_xcopy.c scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough 2018-12-07 21:20:07 -05:00
target_core_xcopy.h