kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-09 18:15:49 +00:00
Code Issues Releases Packages Activity
linux/drivers/target
History
David Disseldorp 1cd41d1669 scsi: target: core: Fix target_cmd_counter leak 
[ Upstream commit d14e3e553e ]

The target_cmd_counter struct allocated via target_alloc_cmd_counter() is
never freed, resulting in leaks across various transport types, e.g.:

 unreferenced object 0xffff88801f920120 (size 96):
  comm "sh", pid 102, jiffies 4294892535 (age 713.412s)
  hex dump (first 32 bytes):
    07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 38 01 92 1f 80 88 ff ff  ........8.......
  backtrace:
    [<00000000e58a6252>] kmalloc_trace+0x11/0x20
    [<0000000043af4b2f>] target_alloc_cmd_counter+0x17/0x90 [target_core_mod]
    [<000000007da2dfa7>] target_setup_session+0x2d/0x140 [target_core_mod]
    [<0000000068feef86>] tcm_loop_tpg_nexus_store+0x19b/0x350 [tcm_loop]
    [<000000006a80e021>] configfs_write_iter+0xb1/0x120
    [<00000000e9f4d860>] vfs_write+0x2e4/0x3c0
    [<000000008143433b>] ksys_write+0x80/0xb0
    [<00000000a7df29b2>] do_syscall_64+0x42/0x90
    [<0000000053f45fb8>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Free the structure alongside the corresponding iscsit_conn / se_sess
parent.

Signed-off-by: David Disseldorp <ddiss@suse.de>
Link: https://lore.kernel.org/r/20230831183459.6938-1-ddiss@suse.de
Fixes: becd9be606 ("scsi: target: Move sess cmd counter to new struct")
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-09-23 11:11:09 +02:00
..
iscsi scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() 2023-09-23 11:11:07 +02:00
loopback scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() 2022-11-17 17:46:16 +00:00
sbp scsi: target: sbp: Replace enable attr with ops.enable 2021-10-04 23:27:38 -04:00
tcm_fc scsi: target: tcm_fc: Fix a kernel-doc header 2021-04-15 22:44:41 -04:00
Kconfig scsi: core: Rename CONFIG_BLK_SCSI_REQUEST to CONFIG_SCSI_COMMON 2021-07-28 22:24:27 -04:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
target_core_alua.c scsi: target: alua: Do not report emtpy port group 2022-09-15 21:42:44 -04:00
target_core_alua.h Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2017-11-24 19:19:20 -10:00
target_core_configfs.c scsi: target: Detect UNMAP support post configuration 2022-07-07 16:53:53 -04:00
target_core_device.c scsi: target: Fix multiple LUN_RESET handling 2023-05-11 23:03:19 +09:00
target_core_fabric_configfs.c scsi: target: configfs: Delete unnecessary checks for NULL 2021-11-18 23:07:02 -05:00
target_core_fabric_lib.c scsi: target: Handle short iSIDs 2020-07-08 00:14:34 -04:00
target_core_file.c use less confusing names for iov_iter direction initializers 2023-02-09 11:28:04 +01:00
target_core_file.h scsi: target: target/file: Add support of direct and async I/O 2018-05-14 22:40:08 -04:00
target_core_hba.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
target_core_iblock.c scsi: target: iblock: Fold iblock_emulate_read_cap_with_block_size() into iblock_get_blocks() 2022-10-01 05:51:47 -04:00
target_core_iblock.h scsi: target: iblock: Add backend plug/unplug callouts 2021-03-04 17:37:02 -05:00
target_core_internal.h scsi: target: Move cmd counter allocation 2023-05-11 23:03:19 +09:00
target_core_pr.c scsi: target: core: New key must be used for moved PR 2022-10-01 05:03:57 -04:00
target_core_pr.h scsi: target: core: Unify NAA identifier generation 2021-05-15 14:14:28 -04:00
target_core_pscsi.c SCSI misc on 20221007 2022-10-07 12:33:18 -07:00
target_core_pscsi.h scsi: target: pscsi: Remove struct pscsi_plugin_task 2022-03-01 22:21:49 -05:00
target_core_rd.c scsi: target: Add the DUMMY flag to rd_mcp 2021-04-05 23:26:38 -04:00
target_core_rd.h scsi: target: Add the DUMMY flag to rd_mcp 2021-04-05 23:26:38 -04:00
target_core_sbc.c SCSI misc on 20220804 2022-08-04 19:47:37 -07:00
target_core_spc.c scsi: target: core: Set MULTIP bit for se_device with multiple ports 2022-09-15 21:40:58 -04:00
target_core_stat.c scsi: target: core: De-RCU of se_lun and se_lun acl 2022-08-01 19:36:02 -04:00
target_core_tmr.c scsi: target: Fix multiple LUN_RESET handling 2023-05-11 23:03:19 +09:00
target_core_tpg.c scsi: target: Move sess cmd counter to new struct 2023-05-11 23:03:19 +09:00
target_core_transport.c scsi: target: core: Fix target_cmd_counter leak 2023-09-23 11:11:09 +02:00
target_core_ua.c scsi: target: use an enum to track emulate_ua_intlck_ctrl 2020-02-21 17:37:16 -05:00
target_core_ua.h scsi: target: Fix handling of removed LUNs 2018-07-02 16:44:32 -04:00
target_core_user.c genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
target_core_xcopy.c scsi: target: Pass in cmd counter to use during cmd setup 2023-05-11 23:03:19 +09:00
target_core_xcopy.h scsi: target: core: Change the way target_xcopy_do_work() sets restiction on max I/O 2023-05-11 23:03:19 +09:00