Patch "target: Fix race for SCF_COMPARE_AND_WRITE_POST checking" has been added to the 3.14-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
target: Fix race for SCF_COMPARE_AND_WRITE_POST checking
to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
target-fix-race-for-scf_compare_and_write_post-checking.patch
and it can be found in the queue-3.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
057085e522f8bf94c2e691a5b76880f68060f8baMon Sep 17 00:00:00 2001
From: Nicholas Bellinger <[email protected]>
Date: Thu, 5 Nov 2015 23:37:59 -0800
Subject: target: Fix race for SCF_COMPARE_AND_WRITE_POST checking
From: Nicholas Bellinger <[email protected]>
commit 057085e522f8bf94c2e691a5b76880f68060f8ba upstream.
This patch addresses a race + use after free where the first stage of COMPARE_AND_WRITE in compare_and_write_callback() is rescheduled after the backend sends the secondary WRITE, resulting in second stage compare_and_write_post() callback completing in target_complete_ok_work() before the first can return.
Because current code depends on checking se_cmd->se_cmd_flags after return from se_cmd->transport_complete_callback(), this results in first stage having SCF_COMPARE_AND_WRITE_POST set, which incorrectly falls through into second stage CAW processing code, eventually triggering a NULL pointer dereference due to use after free.
To address this bug, pass in a new *post_ret parameter into se_cmd->transport_complete_callback(), and depend upon this value instead of ->se_cmd_flags to determine when to return or fall through into ->queue_status() code for CAW.
--- drivers/target/target_core_sbc.c | 13 +++++++++---- drivers/target/target_core_transport.c | 16 +++++++++------- include/target/target_core_base.h | 2 +- 3 files changed, 19 insertions(+), 12 deletions(-)
drivers/target/target_core_sbc.c +9 -4
@@ -314,7 +314,8 @@ sbc_setup_write_same(struct se_cmd *cmd,return 0 ; } -static sense_reason_t xdreadwrite_callback (struct se_cmd *cmd,bool success) +static sense_reason_t xdreadwrite_callback (struct se_cmd *cmd,bool success, +int *post_ret) {unsigned char *buf, *addr;struct scatterlist *sg;
@@ -378,7 +379,8 @@ sbc_execute_rw(struct se_cmd *cmd) cmd->data_direction); } -static sense_reason_t compare_and_write_post (struct se_cmd *cmd,bool success) +static sense_reason_t compare_and_write_post (struct se_cmd *cmd,bool success, +int *post_ret) {struct se_device *dev = cmd->se_dev;
@@ -388,8 +390,10 @@ static sense_reason_t compare_and_write_* sent to the backend driver. */ spin_lock_irq (&cmd->t_state_lock); -if ((cmd->transport_state &CMD_T_SENT ) && !cmd->scsi_status) +if ((cmd->transport_state &CMD_T_SENT ) && !cmd->scsi_status) { cmd->se_cmd_flags |=SCF_COMPARE_AND_WRITE_POST ; + *post_ret =1 ; + }spin_unlock_irq (&cmd->t_state_lock);/*
@@ -401,7 +405,8 @@ static sense_reason_t compare_and_write_return TCM_NO_SENSE ; } -static sense_reason_t compare_and_write_callback (struct se_cmd *cmd,bool success) +static sense_reason_t compare_and_write_callback (struct se_cmd *cmd,bool success, +int *post_ret) {struct se_device *dev = cmd->se_dev;struct scatterlist *write_sg =NULL , *sg;
drivers/target/target_core_transport.c +9 -7
@@ -1581,7 +1581,7 @@ bool target_stop_cmd(struct se_cmd *cmd,void transport_generic_request_failure (struct se_cmd *cmd,sense_reason_t sense_reason) { -int ret =0 ; +int ret =0 , post_ret =0 ; pr_debug("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08x" " CDB: 0x%02x\n", cmd, cmd->se_tfo->get_task_tag(cmd),
@@ -1604,7 +1604,7 @@ void transport_generic_request_failure(s*/ if ((cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE ) && cmd->transport_complete_callback) - cmd->transport_complete_callback (cmd, false); + cmd->transport_complete_callback (cmd, false, &post_ret);switch (sense_reason) {case TCM_NON_EXISTENT_LUN :
@@ -1940,11 +1940,13 @@ static void target_complete_ok_work(stru*/ if (cmd->transport_complete_callback) {sense_reason_t rc; - - rc = cmd->transport_complete_callback (cmd, true); -if (!rc && !(cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE_POST )) { -if ((cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE ) && - !cmd->data_length) +bool caw = (cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE ); +bool zero_dl = !(cmd->data_length); +int post_ret =0 ; + + rc = cmd->transport_complete_callback (cmd, true, &post_ret); +if (!rc && !post_ret) { +if (caw && zero_dl) goto queue_rsp;return ;
include/target/target_core_base.h +1 -1
@@ -513,7 +513,7 @@ struct se_cmd {sense_reason_t (*execute_cmd)(struct se_cmd *);sense_reason_t (*execute_rw)(struct se_cmd *,struct scatterlist *,u32 ,enum dma_data_direction ); -sense_reason_t (*transport_complete_callback)(struct se_cmd *,bool ); +sense_reason_t (*transport_complete_callback)(struct se_cmd *,bool ,int *);unsigned char *t_task_cdb;unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE ];
Patches currently in stable-queue which might be from [email protected] are
queue-3.14/target-fix-compare_and_write-non-zero-sgl-offset-data-corruption.patch queue-3.14/target-fix-race-for-scf_compare_and_write_post-checking.patch