kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/target/iscsi
History
Alexei Potashnik 96e149306e target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT 
commit 9547308bda upstream.

Make sure all non-READ SCSI commands get targ_xfer_tag initialized
to 0xffffffff, not just WRITEs.

Double-free of a TUR cmd object occurs under the following scenario:

1. TUR received (targ_xfer_tag is uninitialized and left at 0)
2. TUR status sent
3. First unsolicited NOPIN is sent to initiator (gets targ_xfer_tag of 0)
4. NOPOUT for NOPIN (with TTT=0) arrives
 - its ExpStatSN acks TUR status, TUR is queued for removal
 - LIO tries to find NOPIN with TTT=0, but finds the same TUR instead,
   TUR is queued for removal for the 2nd time

(Drop unbalanced conditional bracket usage - nab)

Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Signed-off-by: Spencer Baugh <sbaugh@catern.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[ luis: backported to 3.16:
  - kept brackets as they are needed in 3.16 kernel ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2015-08-31 14:14:07 +01:00
..
iscsi_target.c target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT 2015-08-31 14:14:07 +01:00
iscsi_target.h iscsi/iser-target: Convert to command priv_size usage 2013-09-09 14:29:21 -07:00
iscsi_target_auth.c iscsi-target; Enforce 1024 byte maximum for CHAP_C key value 2014-06-26 20:56:42 -07:00
iscsi_target_auth.h iscsi-target: Fix CHAP_A parameter list handling 2014-06-05 19:44:02 -07:00
iscsi_target_configfs.c target: Add TFO->abort_task for aborted task resources release 2014-04-07 01:48:51 -07:00
iscsi_target_configfs.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_core.h iscsi-target: Fix iscsit_start_kthreads failure OOPs 2015-08-20 19:58:05 +01:00
iscsi_target_datain_values.c target: Update copyright ownership/year information to 2013 2013-09-10 20:23:36 -07:00
iscsi_target_datain_values.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_device.c iscsi-target: Fix mutex_trylock usage in iscsit_increment_maxcmdsn 2013-11-12 17:54:56 -08:00
iscsi_target_device.h target/iscsi: Remove unneeded wrapper functions 2012-02-25 14:37:47 -08:00
iscsi_target_erl0.c iscsi-target: Convert iscsi_thread_set usage to kthread.h 2015-05-05 11:09:38 +01:00
iscsi_target_erl0.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_erl1.c iscsi-target: Fix SNACK Type 1 + BegRun=0 handling 2014-02-12 15:11:17 -08:00
iscsi_target_erl1.h iscsit: use the itt_t abstract type 2012-10-03 14:21:50 -07:00
iscsi_target_erl2.c iscsi/iser-target: Use list_del_init for ->i_conn_node 2014-03-04 17:54:09 -08:00
iscsi_target_erl2.h iscsit: proper endianess conversions 2012-10-03 14:39:22 -07:00
iscsi_target_login.c iscsi-target: Fix iscsit_start_kthreads failure OOPs 2015-08-20 19:58:05 +01:00
iscsi_target_login.h iscsi-target: Fix iscsit_start_kthreads failure OOPs 2015-08-20 19:58:05 +01:00
iscsi_target_nego.c iscsi-target: Fix iscsit_start_kthreads failure OOPs 2015-08-20 19:58:05 +01:00
iscsi_target_nego.h iscsi-target: Initial traditional TCP conversion to iscsit_transport 2013-04-25 01:05:26 -07:00
iscsi_target_nodeattrib.c iscsi-target: Expose default_erl as TPG attribute 2013-11-20 11:57:18 -08:00
iscsi_target_nodeattrib.h iscsi-target: Expose default_erl as TPG attribute 2013-11-20 11:57:18 -08:00
iscsi_target_parameters.c iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure 2014-10-05 13:41:05 -07:00
iscsi_target_parameters.h iscsi-target: fix heap buffer overflow on error 2013-05-30 18:07:54 -07:00
iscsi_target_seq_pdu_list.c target: Update copyright ownership/year information to 2013 2013-09-10 20:23:36 -07:00
iscsi_target_seq_pdu_list.h target/iscsi: Fold _decide_list_to_build into _build_pdu_and_seq_lists 2012-04-14 17:40:38 -07:00
iscsi_target_stat.c iscsi-target: Convert iscsi_session statistics to atomic_long_t 2013-11-19 21:38:52 -08:00
iscsi_target_stat.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_tmr.c target: Update copyright ownership/year information to 2013 2013-09-10 20:23:36 -07:00
iscsi_target_tmr.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_tpg.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2014-06-12 22:38:32 -07:00
iscsi_target_tpg.h iscsi-target: Remove no-op from iscsit_tpg_del_portal_group 2014-06-05 19:44:40 -07:00
iscsi_target_tq.c iscsi-target: Drop problematic active_ts_list usage 2015-03-02 13:17:18 +00:00
iscsi_target_tq.h iscsi-target: Add thread_set->ts_activate_sem + use common deallocate 2013-09-10 20:23:05 -07:00
iscsi_target_transport.c iscsi-target: Add iscsit_transport API template 2013-04-25 01:05:26 -07:00
iscsi_target_util.c iscsi-target: Fail connection on short sendmsg writes 2015-01-15 10:44:34 +00:00
iscsi_target_util.h target: Add TFO->abort_task for aborted task resources release 2014-04-07 01:48:51 -07:00
Kconfig target: iscsi_target depends on NET 2011-07-28 20:16:18 +00:00
Makefile iscsi-target: Add iscsit_transport API template 2013-04-25 01:05:26 -07:00