From patchwork Fri Jul 31 06:10:16 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Nicholas A. Bellinger" X-Patchwork-Id: 6908281 Return-Path: X-Original-To: patchwork-linux-scsi@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 48CBEC05AC for ; Fri, 31 Jul 2015 06:10:47 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5EB2F205BB for ; Fri, 31 Jul 2015 06:10:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 65E3C20459 for ; Fri, 31 Jul 2015 06:10:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751578AbbGaGKU (ORCPT ); Fri, 31 Jul 2015 02:10:20 -0400 Received: from mail.linux-iscsi.org ([67.23.28.174]:52749 "EHLO linux-iscsi.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751423AbbGaGKS (ORCPT ); Fri, 31 Jul 2015 02:10:18 -0400 Received: from [192.168.1.67] (75-37-194-224.lightspeed.lsatca.sbcglobal.net [75.37.194.224]) (using SSLv3 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: nab) by linux-iscsi.org (Postfix) with ESMTPSA id 6FF8122DA15; Fri, 31 Jul 2015 06:05:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=linux-iscsi.org; s=default.private; t=1438322732; bh=Vejfi+O1k/xO8nwRcI/Sod78AbFK5I+ e02i1MWawOm0=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To: References:Content-Type:Mime-Version:Content-Transfer-Encoding; b=CPqYVCCaCWWk/RZ+mdHSJESDo+07dqarA06/F3iig08x+o1T99V9V/s2bRRobL4KU +9Jc4dG0gIHr4foYNb4NL4q1kdhYMS9RVKS8AUWT5Edcx+MjP1+MxqiGG2xg8K4snof zWAuJ3zue9FA7PxJFGnOPW9tFJpqqEWC2Nx1IQc= Message-ID: <1438323016.16598.11.camel@haakon3.risingtidesystems.com> Subject: Re: [PATCH] target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT From: "Nicholas A. Bellinger" To: Spencer Baugh Cc: Sagi Grimberg , Christoph Hellwig , Bart Van Assche , Andy Grover , Alexei Potashnik , Christophe Vu-Brugier , "open list:TARGET SUBSYSTEM" , "open list:TARGET SUBSYSTEM" , open list , Joern Engel , Spencer Baugh Date: Thu, 30 Jul 2015 23:10:16 -0700 In-Reply-To: <1437516477-30554-4-git-send-email-sbaugh@catern.com> References: <1437516477-30554-4-git-send-email-sbaugh@catern.com> X-Mailer: Evolution 3.4.4-1 Mime-Version: 1.0 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Spam-Status: No, score=-8.2 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hi Spencer & Alexei, On Tue, 2015-07-21 at 15:07 -0700, Spencer Baugh wrote: > From: Alexei Potashnik > > Make sure all non-READ SCSI commands get targ_xfer_tag initialized > to 0xffffffff, not just WRITEs. > > Double-free of a TUR cmd object occurs under the following scenario: > > 1. TUR received (targ_xfer_tag is uninitialized and left at 0) > 2. TUR status sent > 3. First unsolicited NOPIN is sent to initiator (gets targ_xfer_tag of 0) > 4. NOPOUT for NOPIN (with TTT=0) arrives > - its ExpStatSN acks TUR status, TUR is queued for removal > - LIO tries to find NOPIN with TTT=0, but finds the same TUR instead, > TUR is queued for removal for the 2nd time > > Signed-off-by: Alexei Potashnik > Signed-off-by: Spencer Baugh > --- Very nice catch on this bug. > drivers/target/iscsi/iscsi_target.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c > index a4cf58c..ebb1ece 100644 > --- a/drivers/target/iscsi/iscsi_target.c > +++ b/drivers/target/iscsi/iscsi_target.c > @@ -970,7 +970,7 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, > conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt; > if (hdr->flags & ISCSI_FLAG_CMD_READ) { > cmd->targ_xfer_tag = session_get_next_ttt(conn->sess); > - } else if (hdr->flags & ISCSI_FLAG_CMD_WRITE) > + } else > cmd->targ_xfer_tag = 0xFFFFFFFF; > cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); > cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn); One small nit. linux kernel coding style says conditionals should use matching brackets. Since it's a single line body, no reason to use brackets at all. Applying the updated patch below to target-pending/master with CC' for 3.1 stable. Thanks! --- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index cd77a06..fd09290 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -968,9 +968,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, cmd->cmd_flags |= ICF_NON_IMMEDIATE_UNSOLICITED_DATA; conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt; - if (hdr->flags & ISCSI_FLAG_CMD_READ) { + if (hdr->flags & ISCSI_FLAG_CMD_READ) cmd->targ_xfer_tag = session_get_next_ttt(conn->sess); - } else if (hdr->flags & ISCSI_FLAG_CMD_WRITE) + else cmd->targ_xfer_tag = 0xFFFFFFFF; cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);