kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Jan Engelhardt 39eb977a0a target: fix COMPARE_AND_WRITE non zero SGL offset data corruption 
commit d94e5a6135 upstream.

target_core_sbc's compare_and_write functionality suffers from taking
data at the wrong memory location when writing a CAW request to disk
when a SGL offset is non-zero.

This can happen with loopback and vhost-scsi fabric drivers when
SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is used to map existing user-space
SGL memory into COMPARE_AND_WRITE READ/WRITE payload buffers.

Given the following sample LIO subtopology,

% targetcli ls /loopback/
o- loopback ................................. [1 Target]
  o- naa.6001405ebb8df14a ....... [naa.60014059143ed2b3]
    o- luns ................................... [2 LUNs]
      o- lun0 ................ [iblock/ram0 (/dev/ram0)]
      o- lun1 ................ [iblock/ram1 (/dev/ram1)]
% lsscsi -g
[3:0:1:0]    disk    LIO-ORG  IBLOCK           4.0   /dev/sdc   /dev/sg3
[3:0:1:1]    disk    LIO-ORG  IBLOCK           4.0   /dev/sdd   /dev/sg4

the following bug can be observed in Linux 4.3 and 4.4~rc1:

% perl -e 'print chr$_ for 0..255,reverse 0..255' >rand
% perl -e 'print "\0" x 512' >zero
% cat rand >/dev/sdd
% sg_compare_and_write -i rand -D zero --lba 0 /dev/sdd
% sg_compare_and_write -i zero -D rand --lba 0 /dev/sdd
Miscompare reported
% hexdump -Cn 512 /dev/sdd
00000000  0f 0e 0d 0c 0b 0a 09 08  07 06 05 04 03 02 01 00
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
*
00000200

Rather than writing all-zeroes as instructed with the -D file, it
corrupts the data in the sector by splicing some of the original
bytes in. The page of the first entry of cmd->t_data_sg includes the
CDB, and sg->offset is set to a position past the CDB. I presume that
sg->offset is also the right choice to use for subsequent sglist
members.

Signed-off-by: Jan Engelhardt <jengelh@netitwork.de>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2015-12-18 16:06:39 +00:00
..
accessibility printk: move braille console support into separate braille.[ch] files 2013-07-31 14:41:03 -07:00
acpi ACPI: Use correct IRQ when uninstalling ACPI interrupt handler 2015-12-13 17:48:55 +00:00
amba ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
ata Add factory recertified Crucial M500s to blacklist 2015-09-03 13:29:57 +01:00
atm atm: fore200e.c: Cleaning up uninitialized variables 2014-06-02 17:11:03 -07:00
auxdisplay auxdisplay: ks0108: fix refcount 2015-09-28 10:21:35 +01:00
base regmap: debugfs: Don't bother actually printing when calculating max length 2015-10-30 13:59:26 +00:00
bcma bcma: gpio: register 32 GPIOs on BCM5357 2014-03-27 14:20:04 -04:00
block rbd: require stable pages if message data CRCs are enabled 2015-11-16 11:27:15 +00:00
bluetooth Bluetooth: ath3k: Add support of AR3012 0cf3:817b device 2015-12-13 17:48:52 +00:00
bus bus: omap_l3_noc: Correct returning IRQ_HANDLED unconditionally in the irq handler 2015-02-04 10:57:52 +00:00
cdrom Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2014-06-11 08:41:17 -07:00
char TPM: Avoid reference to potentially freed memory 2015-12-13 17:49:45 +00:00
clk clk: versatile-icst: fix memory leak 2015-12-13 17:49:38 +00:00
clocksource clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier 2015-07-15 10:00:56 +01:00
connector Char / misc driver patches for 3.16-rc1 2014-06-03 08:06:56 -07:00
cpufreq intel_pstate: Fix overflow in busy_scaled due to long delay 2015-10-19 12:16:31 +01:00
cpuidle cpuidle: remove state_count field from struct cpuidle_device 2015-04-27 16:16:34 +01:00
crypto crypto: caam - fix memory corruption in ahash_final_ctx 2015-09-03 13:29:51 +01:00
dca dca: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
devfreq PM / devfreq: remove checks for CONFIG_EXYNOS_ASV 2014-05-24 22:33:51 +09:00
dio m68k: don't export static inline functions 2009-12-06 11:18:28 +01:00
dma dmaengine: dw: convert to __ffs() 2015-12-13 17:49:28 +00:00
edac EDAC, ppc4xx: Access mci->csrows array elements properly 2015-09-03 13:29:51 +01:00
eisa Revert "EISA: Initialize device before its resources" 2014-01-17 14:57:29 -07:00
extcon extcon: palmas: Use devm_extcon_dev_allocate for extcon_dev 2014-04-29 09:52:12 +09:00
firewire firewire: ohci: fix JMicron JMB38x IT context discovery 2015-12-13 17:49:09 +00:00
firmware sysfs: Create mountpoints with sysfs_create_mount_point 2015-08-20 18:24:03 +01:00
fmc Merge 3.14-rc5 into char-misc-next 2014-03-02 19:53:09 -08:00
gpio gpio: gpio-kempld: Fix get_direction return value 2015-06-03 13:27:19 +01:00
gpu drm/radeon: make some dpm errors debug only 2015-12-18 16:06:36 +00:00
hid HID: core: Avoid uninitialized buffer access 2015-12-09 11:40:57 +00:00
hsi hsi: omap_ssi_port: Prevent warning if cawake_gpio is not defined. 2015-12-13 17:49:33 +00:00
hv Drivers: hv: vmbus: Don't wait after requesting offers 2015-05-05 11:09:38 +01:00
hwmon hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips 2015-10-06 11:52:27 +01:00
hwspinlock A single patch from Vincent extending OMAP's hwspinlock support to OMAP5. 2013-05-07 14:01:27 -07:00
i2c i2c: mv64xxx: really allow I2C offloading 2015-11-16 11:27:12 +00:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide 2014-07-21 22:44:24 -07:00
idle intel_idle: fix IVT idle state table setting 2014-04-21 23:36:07 +02:00
iio iio: adc: xilinx: Fix VREFN scale 2015-12-14 10:17:08 +00:00
infiniband IB/cm: Fix rb-tree duplicate free and use-after-free 2015-11-16 11:27:08 +00:00
input Input: elantech - add Fujitsu Lifebook U745 to force crc_enabled 2015-12-13 17:49:11 +00:00
iommu iommu/vt-d: Fix ATSR handling for Root-Complex integrated endpoints 2015-12-13 17:48:45 +00:00
ipack ipack: convert bus code to use dev_groups 2013-10-16 18:40:57 -07:00
irqchip irqchip: sunxi-nmi: Fix off-by-one error in irq iterator 2015-06-30 17:15:21 +01:00
isdn ppp, slip: Validate VJ compression slot parameters completely 2015-11-16 11:27:22 +00:00
leds leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger 2015-07-09 14:36:01 +01:00
lguest lguest: fix out-by-one error in address checking. 2015-06-03 14:30:03 +01:00
macintosh windfarm: decrement client count when unregistering 2015-09-30 13:20:39 +01:00
mailbox drivers/mailbox/omap: make mbox->irq signed for error handling 2014-01-23 16:36:53 -08:00
mcb mcb: Add support for shared PCI IRQs 2014-05-27 17:38:11 -07:00
md dm: fix ioctl retry termination with signal 2015-12-18 16:06:27 +00:00
media [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish 2015-12-13 17:48:50 +00:00
memory memory: mvebu-devbus: add a devbus, keep-config property 2014-04-29 13:17:10 +00:00
memstick memstick: mspro_block: add missing curly braces 2015-05-06 11:33:10 +01:00
message mptfusion: enable no_write_same for vmware scsi disks 2014-10-30 09:40:12 -07:00
mfd mfd: twl6040: Fix deferred probe handling for clk32k 2015-12-13 17:49:39 +00:00
misc mei: make device disabled on stop unconditionally 2015-03-18 15:06:06 +00:00
mmc mmc: remove bondage between REQ_META and reliable write 2015-12-14 10:17:12 +00:00
mtd mtd: blkdevs: fix potential deadlock + lockdep warnings 2015-12-13 17:49:00 +00:00
net broadcom: fix PHY_ID_BCM5481 entry in the id table 2015-12-18 16:06:23 +00:00
nfc NFC: microread: Potential overflows in microread_target_discovered() 2014-10-05 13:41:05 -07:00
ntb ntb: Use pci_enable_msix_range() instead of pci_enable_msix() 2014-04-07 10:59:20 -07:00
nubus kernel/printk: use symbolic defines for console loglevels 2014-06-04 16:54:17 -07:00
of of/fdt: fix error checking for earlycon address 2015-12-13 17:49:40 +00:00
oprofile oprofile, nmi-timer: Fix CPU hotplug callback registration 2014-03-20 13:43:46 +01:00
parisc PCI changes for the v3.12 merge window: 2013-09-03 16:24:35 -07:00
parport parport: fix menu breakage 2014-07-25 18:00:23 -07:00
pci PCI: Use function 0 VPD for identical functions, regular VPD for others 2015-10-19 10:54:35 +01:00
pcmcia Disable write buffering on Toshiba ToPIC95 2015-07-15 10:00:33 +01:00
phy phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function. 2015-07-15 10:01:23 +01:00
pinctrl pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs 2015-07-15 10:00:30 +01:00
platform ideapad-laptop: Add Lenovo Yoga 900 to no_hw_rfkill dmi list 2015-12-13 17:49:18 +00:00
pnp ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage 2015-07-15 10:01:34 +01:00
power wm831x_power: Use IRQF_ONESHOT to request threaded IRQs 2015-12-13 17:49:27 +00:00
powercap powercap / RAPL: add support for CPU model 0x3f 2015-01-15 10:44:49 +00:00
pps drivers/pps/clients/pps-gpio.c: remove redundant of_match_ptr 2013-11-13 12:09:35 +09:00
ps3 ps3-vuart: don't use PREPARE_WORK 2014-03-07 10:24:48 -05:00
ptp ptp: ptp_pch depends on x86_32 2014-06-17 15:43:48 -07:00
pwm pwm: Fix period and polarity in pwm_get() for non-perfect matches 2014-10-05 13:40:52 -07:00
rapidio rapidio/tsi721_dma: fix failure to obtain transaction descriptor 2014-07-30 17:16:13 -07:00
regulator regulator: pbias: Fix broken pbias disable functionality 2015-09-28 10:21:40 +01:00
remoteproc remoteproc: da8xx: don't select CMA on no-MMU 2014-06-17 17:09:36 +02:00
reset reset: sunxi: fix spinlock initialization 2015-01-22 16:33:34 +00:00
rpmsg A small pull request consisting of: 2013-05-07 14:02:00 -07:00
rtc rtc: ds1307: Fix alarm programming for mcp794xx 2015-12-13 17:49:45 +00:00
s390 s390/sclp: fix compile error 2015-09-03 13:30:01 +01:00
sbus bbc-i2c: Fix BBC I2C envctrl on SunBlade 2000 2014-08-14 10:09:44 +08:00
scsi storvsc: Don't set the SRB_FLAGS_QUEUE_ACTION_ENABLE flag 2015-12-13 17:49:19 +00:00
sfi SFI / ACPI: Fix warnings reported during builds with W=1 2013-12-07 01:24:33 +01:00
sh SH Driver Update for v3.16 2014-06-06 11:44:09 -07:00
sn Drivers: misc: remove __dev* attributes. 2013-01-03 15:57:16 -08:00
soc soc: qcom: fix of_device_id table 2014-05-26 21:27:09 +02:00
spi spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word 2015-12-13 17:48:53 +00:00
spmi spmi: pm: drop bus-level PM suspend/resume routines 2014-03-08 22:15:52 -08:00
ssb Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2014-01-30 17:20:32 -08:00
staging iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock 2015-12-14 10:17:07 +00:00
target target: fix COMPARE_AND_WRITE non zero SGL offset data corruption 2015-12-18 16:06:39 +00:00
tc TC: Handle device_register() errors. 2014-06-26 10:48:23 +01:00
thermal thermal: exynos: Fix unbalanced regulator disable on probe failure 2015-12-13 17:49:07 +00:00
tty tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c 2015-12-13 17:49:50 +00:00
uio Revert "uio: fix vma io range check in mmap" 2014-06-17 16:07:08 -07:00
usb usb: musb: core: fix order of arguments to ulpi write callback 2015-12-14 10:17:13 +00:00
uwb uwb: init beacon cache entry before registering uwb device 2014-10-05 13:40:58 -07:00
vfio vfio-pci: Fix the check on pci device type in vfio_pci_probe() 2015-01-16 14:34:28 +00:00
vhost vhost: actually track log eventfd file 2015-08-25 10:13:39 +01:00
video video/fbdev: fix defio's fsync 2015-01-16 14:34:19 +00:00
virt drivers: clean-up prom.h implicit includes 2013-10-09 20:04:04 -05:00
virtio virtio_pci: Clear stale cpumask when setting irq affinity 2015-06-30 17:15:20 +01:00
vlynq drivers/vlynq/vlynq.c: fix another resource size off by 1 error 2014-01-23 16:36:55 -08:00
vme vme_tsi148: Utilize to_pci_dev() macro 2014-04-16 14:08:37 -07:00
w1 w1_therm reference count family data 2015-07-09 14:36:07 +01:00
watchdog watchdog: omap: assert the counter being stopped before reprogramming 2015-07-15 10:01:29 +01:00
xen xen/gntdev: Grant maps should not be subject to NUMA balancing 2015-12-18 16:06:37 +00:00
zorro zorro/UAPI: Use proper types (endianness/size) in <linux/zorro.h> 2013-11-26 11:09:09 +01:00
Kconfig soc: Introduce drivers/soc place-holder for SOC specific drivers 2014-05-23 11:37:46 -05:00
Makefile Char / misc driver patches for 3.16-rc1 2014-06-03 08:06:56 -07:00