Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Nicholas Bellinger 2f3897ea94 target: Fix race for SCF_COMPARE_AND_WRITE_POST checking ... commit 057085e522 upstream. This patch addresses a race + use after free where the first stage of COMPARE_AND_WRITE in compare_and_write_callback() is rescheduled after the backend sends the secondary WRITE, resulting in second stage compare_and_write_post() callback completing in target_complete_ok_work() before the first can return. Because current code depends on checking se_cmd->se_cmd_flags after return from se_cmd->transport_complete_callback(), this results in first stage having SCF_COMPARE_AND_WRITE_POST set, which incorrectly falls through into second stage CAW processing code, eventually triggering a NULL pointer dereference due to use after free. To address this bug, pass in a new *post_ret parameter into se_cmd->transport_complete_callback(), and depend upon this value instead of ->se_cmd_flags to determine when to return or fall through into ->queue_status() code for CAW. Cc: Sagi Grimberg <sagig@mellanox.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> [ luis: backported to 3.16: adjusted context ] Signed-off-by: Luis Henriques <luis.henriques@canonical.com>		History 2015-12-18 16:06:38 +00:00
..
iscsi	Target/iscsi: Fix sendtargets response pdu for iser transport	2014-06-11 11:52:39 -07:00
configfs_macros.h	doc: fix broken references	2011-09-27 18:08:04 +02:00
target_core_backend.h	target: Report correct response length for some commands	2014-06-11 12:15:30 -07:00
target_core_base.h	target: Fix race for SCF_COMPARE_AND_WRITE_POST checking	2015-12-18 16:06:38 +00:00
target_core_configfs.h	target: Remove TF_CIT_TMPL macro	2013-10-16 13:35:02 -07:00
target_core_fabric.h	target: Pass in transport supported PI at session initialization	2014-04-07 01:48:54 -07:00
target_core_fabric_configfs.h	target: Add se_portal_group->tpg_auth_group	2013-07-03 19:44:31 -07:00