diff options
author | 2011-06-23 23:48:32 +0000 | |
---|---|---|
committer | 2011-06-23 23:59:45 +0000 | |
commit | 7fd29aa920273b70be50c14c4b7e2213fb6623ce (patch) | |
tree | e8fc3c2526db9cb1c76c91ca56434b5261f260f9 /drivers | |
parent | Merge tag 'v3.0-rc4' of /pub/scm/linux/kernel/git/torvalds/linux-2.6 into for... (diff) | |
download | linux-7fd29aa920273b70be50c14c4b7e2213fb6623ce.tar.gz linux-7fd29aa920273b70be50c14c4b7e2213fb6623ce.tar.bz2 linux-7fd29aa920273b70be50c14c4b7e2213fb6623ce.zip |
target: Fix transport_get_lun_for_tmr failure cases
This patch fixes two possible NULL pointer dereferences in target v4.0
code where se_tmr release path in core_tmr_release_req() can OOPs upon
transport_get_lun_for_tmr() failure by attempting to access se_device or
se_tmr->tmr_list without a valid member of se_device->tmr_list during
transport_free_se_cmd() release. This patch moves the se_tmr->tmr_dev
pointer assignment in transport_get_lun_for_tmr() until after possible
-ENODEV failures during unpacked_lun lookup.
This addresses an OOPs originally reported with LIO v4.1 upstream on
.39 code here:
TARGET_CORE[qla2xxx]: Detected NON_EXISTENT_LUN Access for 0x00000000
BUG: unable to handle kernel NULL pointer dereference at 0000000000000550
IP: [<ffffffff81035ec4>] __ticket_spin_trylock+0x4/0x20
PGD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/system/cpu/cpu23/cache/index2/shared_cpu_map
CPU 1
Modules linked in: netconsole target_core_pscsi target_core_file
tcm_qla2xxx target_core_iblock tcm_loop target_core_mod configfs
ipmi_devintf ipmi_si ipmi_msghandler serio_raw i7core_edac ioatdma dca
edac_core ps_bdrv ses enclosure usbhid usb_storage ahci qla2xxx hid
uas e1000e mpt2sas libahci mlx4_core scsi_transport_fc
scsi_transport_sas raid_class scsi_tgt [last unloaded: netconsole]
Pid: 0, comm: kworker/0:0 Tainted: G W 2.6.39+ #1 Xyratex Storage Server
RIP: 0010:[<ffffffff81035ec4>] [<ffffffff81035ec4>]__ticket_spin_trylock+0x4/0x20
RSP: 0018:ffff88063e803c08 EFLAGS: 00010286
RAX: ffff880619ab45e0 RBX: 0000000000000550 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000550
RBP: ffff88063e803c08 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000568
R13: 0000000000000001 R14: 0000000000000000 R15: ffff88060cd96a20
FS: 0000000000000000(0000) GS:ffff88063e800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000550 CR3: 0000000001a03000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process kworker/0:0 (pid: 0, threadinfo ffff880619ab8000, task ffff880619ab45e0)
Stack:
ffff88063e803c28 ffffffff812cf039 0000000000000550 0000000000000568
ffff88063e803c58 ffffffff8157071e ffffffffa028a1dc ffff88060f7e4600
0000000000000550 ffff880616961480 ffff88063e803c78 ffffffffa028a1dc
Call Trace:
<IRQ>
[<ffffffff812cf039>] do_raw_spin_trylock+0x19/0x50
[<ffffffff8157071e>] _raw_spin_lock+0x3e/0x70
[<ffffffffa028a1dc>] ? core_tmr_release_req+0x2c/0x60 [target_core_mod]
[<ffffffffa028a1dc>] core_tmr_release_req+0x2c/0x60 [target_core_mod]
[<ffffffffa028d0d2>] transport_free_se_cmd+0x22/0x50 [target_core_mod]
[<ffffffffa028d120>] transport_release_cmd_to_pool+0x20/0x40 [target_core_mod]
[<ffffffffa028e525>] transport_generic_free_cmd+0xa5/0xb0 [target_core_mod]
[<ffffffffa0147cc4>] tcm_qla2xxx_handle_tmr+0xc4/0xd0 [tcm_qla2xxx]
[<ffffffffa0191ba3>] __qla24xx_handle_abts+0xd3/0x150 [qla2xxx]
[<ffffffffa0197651>] qla_tgt_response_pkt+0x171/0x520 [qla2xxx]
[<ffffffffa0197a2d>] qla_tgt_response_pkt_all_vps+0x2d/0x220 [qla2xxx]
[<ffffffffa0171dd3>] qla24xx_process_response_queue+0x1a3/0x670 [qla2xxx]
[<ffffffffa0196281>] ? qla24xx_atio_pkt+0x81/0x120 [qla2xxx]
[<ffffffffa0174025>] ? qla24xx_msix_default+0x45/0x2a0 [qla2xxx]
[<ffffffffa0174198>] qla24xx_msix_default+0x1b8/0x2a0 [qla2xxx]
[<ffffffff810dadb4>] handle_irq_event_percpu+0x54/0x210
[<ffffffff810dafb8>] handle_irq_event+0x48/0x70
[<ffffffff810dd5ee>] ? handle_edge_irq+0x1e/0x110
[<ffffffff810dd647>] handle_edge_irq+0x77/0x110
[<ffffffff8100d362>] handle_irq+0x22/0x40
[<ffffffff8157b28d>] do_IRQ+0x5d/0xe0
[<ffffffff81571413>] common_interrupt+0x13/0x13
<EOI>
[<ffffffff813003f7>] ? intel_idle+0xd7/0x130
[<ffffffff813003f0>] ? intel_idle+0xd0/0x130
[<ffffffff8144832b>] cpuidle_idle_call+0xab/0x1c0
[<ffffffff8100a26b>] cpu_idle+0xab/0xf0
[<ffffffff81566c59>] start_secondary+0x1cb/0x1d2
Reported-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/target/target_core_device.c | 3 | ||||
-rw-r--r-- | drivers/target/target_core_tmr.c | 8 |
2 files changed, 9 insertions, 2 deletions
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c index 8407f9ca2b31..f8d8af7a0d41 100644 --- a/drivers/target/target_core_device.c +++ b/drivers/target/target_core_device.c @@ -192,7 +192,7 @@ int transport_get_lun_for_tmr( &SE_NODE_ACL(se_sess)->device_list[unpacked_lun]; if (deve->lun_flags & TRANSPORT_LUNFLAGS_INITIATOR_ACCESS) { se_lun = se_cmd->se_lun = se_tmr->tmr_lun = deve->se_lun; - dev = se_tmr->tmr_dev = se_lun->lun_se_dev; + dev = se_lun->lun_se_dev; se_cmd->pr_res_key = deve->pr_res_key; se_cmd->orig_fe_lun = unpacked_lun; se_cmd->se_orig_obj_ptr = SE_LUN(se_cmd)->lun_se_dev; @@ -216,6 +216,7 @@ int transport_get_lun_for_tmr( se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION; return -1; } + se_tmr->tmr_dev = dev; spin_lock(&dev->se_tmr_lock); list_add_tail(&se_tmr->tmr_list, &dev->dev_tmr_list); diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c index 59b8b9c5ad72..179063d81cdd 100644 --- a/drivers/target/target_core_tmr.c +++ b/drivers/target/target_core_tmr.c @@ -75,10 +75,16 @@ void core_tmr_release_req( { struct se_device *dev = tmr->tmr_dev; + if (!dev) { + kmem_cache_free(se_tmr_req_cache, tmr); + return; + } + spin_lock(&dev->se_tmr_lock); list_del(&tmr->tmr_list); - kmem_cache_free(se_tmr_req_cache, tmr); spin_unlock(&dev->se_tmr_lock); + + kmem_cache_free(se_tmr_req_cache, tmr); } static void core_tmr_handle_tas_abort( |