scsi: target: tcm_loop: fix segfault in tcm_loop_tpg_address_show()

PATCH Applied Hamza Mahfooz 4 participants 4 messages Nov 5, 2025 – Nov 13, 2025

Subsystems (3)

Stable branch SCSI SCSI target

lore

Share & tools

lore

Hamza Mahfooz

author

2025-11-05 19:26 UTC #0 lore raw

PATCH 1/1 scsi: target: tcm_loop: fix segfault in tcm_loop_tpg_address_show()

If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it.

Unable to allocate struct scsi_host

  BUG: kernel NULL pointer dereference, address: 0000000000000194
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1
  Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024
  RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]
...
  Call Trace:
   <TASK>
   configfs_read_iter+0x12d/0x1d0 [configfs]
   vfs_read+0x1b5/0x300
   ksys_read+0x6f/0xf0

...

Cc [email protected]

Fixes 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs")

Signed-off-by Hamza Mahfooz <[email protected]>

---
 drivers/target/loopback/tcm_loop.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/target/loopback/tcm_loop.c +3 -0

index c7b7da629741..01a8e349dc4d 100644
@@ -894,6 +894,9 @@ static ssize_t tcm_loop_tpg_address_show(struct config_item *item,
 			struct tcm_loop_tpg, tl_se_tpg);
 	struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;
 
+	if (!tl_hba->sh)
+		return -ENODEV;
+
 	return snprintf(page, PAGE_SIZE, "%d:0:%d\n",
 			tl_hba->sh->host_no, tl_tpg->tl_tpgt);
 }

Signature · 1 line

2.49.0

Chaitanya Kulkarni

Reviewed-by on v1 1/1

2025-11-06 06:41 UTC #1 lore raw

Quoted 20 lines · Hamza Mahfooz

   Unable to allocate struct scsi_host
   BUG: kernel NULL pointer dereference, address: 0000000000000194
   #PF: supervisor read access in kernel mode
   #PF: error_code(0x0000) - not-present page
   PGD 0 P4D 0
   Oops: 0000 [#1] PREEMPT SMP NOPTI
   CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1
   Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024
   RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]
...
   Call Trace:
    <TASK>
    configfs_read_iter+0x12d/0x1d0 [configfs]
    vfs_read+0x1b5/0x300
    ksys_read+0x6f/0xf0

Quoted 6 lines

...
Cc [email protected]
Fixes 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs")
Signed-off-by Hamza Mahfooz<[email protected]>
---

indeed :-

313 static int tcm_loop_driver_probe(struct device *dev) 314 {
315 struct tcm_loop_hba *tl_hba;
316 struct Scsi_Host *sh;
317 int error, host_prot;
318
319 tl_hba = to_tcm_loop_hba(dev);
320
321 sh = scsi_host_alloc(&tcm_loop_driver_template, 322 sizeof(struct tcm_loop_hba)); 323 if (!sh) {
324 pr_err("Unable to allocate struct scsi_host\n"); 325 return -ENODEV;
326 }
327 tl_hba->sh = sh;

Looks good.

Reviewed-by Chaitanya Kulkarni <[email protected]>

-ck

Allen Pais

Reviewed-by on v1 1/1

2025-11-06 15:56 UTC #2 lore raw

In reply to Hamza Mahfooz

Quoted 24 lines · Hamza Mahfooz

If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it.
Unable to allocate struct scsi_host
BUG: kernel NULL pointer dereference, address: 0000000000000194
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1
Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024
RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]
...
Call Trace:
 <TASK>
 configfs_read_iter+0x12d/0x1d0 [configfs]
 vfs_read+0x1b5/0x300
 ksys_read+0x6f/0xf0

Quoted 5 lines

...
Cc [email protected]
Fixes 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs")
Signed-off-by Hamza Mahfooz <[email protected]>

Reviewed-by Allen Pais <[email protected] <mailto:[email protected]>>

Quoted 20 lines

---
drivers/target/loopback/tcm_loop.c | 3 +++

1 file changed, 3 insertions(+)

drivers/target/loopback/tcm_loop.c +3 -0

index c7b7da629741..01a8e349dc4d 100644
@@ -894,6 +894,9 @@ static ssize_t tcm_loop_tpg_address_show(struct config_item *item,
 struct tcm_loop_tpg, tl_se_tpg);
 struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;
 
+ if (!tl_hba->sh)
+ return -ENODEV;
+
 return snprintf(page, PAGE_SIZE, "%d:0:%d\n",
 tl_hba->sh->host_no, tl_tpg->tl_tpgt);
 }

Signature · 1 line

2.49.0

Martin K. Petersen

Applied

2025-11-13 02:49 UTC #3 lore raw

In reply to Hamza Mahfooz

Quoted 20 lines · Hamza Mahfooz

If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it.
Unable to allocate struct scsi_host
  BUG: kernel NULL pointer dereference, address: 0000000000000194
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1
  Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024
  RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]
...
  Call Trace:
   <TASK>
   configfs_read_iter+0x12d/0x1d0 [configfs]
   vfs_read+0x1b5/0x300
   ksys_read+0x6f/0xf0

Quoted 3 lines

...
[...]

Applied to 6.18/scsi-fixes, thanks!

[1/1] scsi: target: tcm_loop: fix segfault in tcm_loop_tpg_address_show()

      https://git.kernel.org/mkp/scsi/c/e6965188f84a

Signature · 1 line

Martin K. Petersen