leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
0a020436d8
linux/drivers/target
History
Nicholas Bellinger 0a020436d8 loopback: Prevent uninitialized use of tl_tpg in tcm_loop_queuecommand 
This patch fixes a bug with tcm_loop where performing a scsi_host rescan was
causing an oops due to a received scsi_cmnd->device->id value not matching a
previously configured tcm_loop_tpg entry in tcm_loop_hba->tl_hba_tpgs[]
obtained from within tcm_loop_queuecommand() code.

This fix adds an explict check for tcm_loop_tpg->tl_hba in order to ensure
tcm_loop_make_naa_tpg() has already been invoked to initialize a given
tcm_loop_tpg entry, and also adds an explict clear of tcm_loop_tpg->tl_hba
from within the tcm_loop_drop_naa_tpg() release path.

This bug was manifesting itself with the following OOPs:

[176289.430909] BUG: unable to handle kernel NULL pointer dereference at 0000000000000090
[176289.431337] IP: [<ffffffffa0395617>] transport_processing_thread+0x1e3/0x794 [target_core_mod]
[176289.431399] PGD 22e9b067 PUD 23375067 PMD 0
[176289.431399] Oops: 0000 [#1] SMP
[176289.431815] CPU 1
[176289.431815] Modules linked in: tcm_loop target_core_stgt target_core_pscsi target_core_file target_core_iblock target_core_mod crc32c ib_cm ib_sa ib_mad ib_core qla2xxx scsi_tgt configfs fcoe libfcoe libfc scsi_transport_fc ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi sr_mod cdrom sd_mod ata_piix libata e1000 mptspi mptscsih mptbase [last unloaded: target_core_mod]
[176289.431815]
[176289.431815] Pid: 12339, comm: LIO_iblock Tainted: G        W   3.1.0-rc8+
[176289.431815] RIP: 0010:[<ffffffffa0395617>]  [<ffffffffa0395617>] transport_processing_thread+0x1e3/0x794 [target_core_mod]
[176289.431815] RSP: 0018:ffff880023bfbe10  EFLAGS: 00010283
[176289.431815] RAX: 0000000000000000 RBX: ffff88002d600040 RCX: ffff88002d600108
[176289.431815] RDX: ffff88000c9e50bc RSI: 0000000000000246 RDI: 0000000000000246
[176289.431815] RBP: ffff880023bfbee0 R08: ffff88002d600108 R09: 0000000000000000
[176289.431815] R10: ffff88002fc8cc80 R11: ffffffff81671b60 R12: ffff88002d600108
[176289.431815] R13: ffff88000c9e4f38 R14: ffff88000c9e50b8 R15: 0000000000000000
[176289.431815] FS:  0000000000000000(0000) GS:ffff88002fc80000(0000) knlGS:0000000000000000
[176289.431815] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[176289.431815] CR2: 0000000000000090 CR3: 000000002a33f000 CR4: 00000000000006e0
[176289.431815] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[176289.431815] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[176289.431815] Process LIO_iblock (pid: 12339, threadinfo ffff880023bfa000, task ffff88002a2e0000)
[176289.431815] Stack:
[176289.431815]  0000000000011280 0000000000000246 ffff88002a2e0000 ffff880023a58900
[176289.431815]  ffff880023bfbed0 ffff880023bfa000 ffff880023bfa000 ffff88000c9e50d0
[176289.431815]  ffff88000c9e50c0 ffff88000c9e50bc ffff880023bfa000 ffff880023bfbfd8
[176289.431815] Call Trace:
[176289.431815]  [<ffffffff81056657>] ? wake_up_bit+0x25/0x25
[176289.431815]  [<ffffffffa0395434>] ? transport_handle_cdb_direct+0x92/0x92 [target_core_mod]
[176289.431815]  [<ffffffff8105619a>] kthread+0x7d/0x85
[176289.431815]  [<ffffffff813cbcb4>] kernel_thread_helper+0x4/0x10
[176289.431815]  [<ffffffff8105611d>] ? kthread_worker_fn+0x16d/0x16d
[176289.431815]  [<ffffffff813cbcb0>] ? gs_change+0x13/0x13
[176289.431815] Code: 67 05 00 00 41 8b 84 24 4c ff ff ff ff c8 83 f8 11 0f 87 f0 04 00 00 89 c0 ff 24 c5 b0 c6 39 a0 0f 0b eb fe 48 8b 83 d8 00 00 00
[176289.431815] RIP  [<ffffffffa0395617>] transport_processing_thread+0x1e3/0x794 [target_core_mod]
[176289.431815]  RSP <ffff880023bfbe10>
[176289.431815] CR2: 0000000000000090
[176295.041004] ---[ end trace 85dc6865b23b8f3e ]---

Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2011-10-24 03:21:01 +00:00
..
iscsi iscsi-target: Remove SCF_SE_LUN_CMD flag abuses 2011-10-24 03:20:56 +00:00
loopback loopback: Prevent uninitialized use of tl_tpg in tcm_loop_queuecommand 2011-10-24 03:21:01 +00:00
tcm_fc target: Have core_tmr_alloc_req() take an explicit GFP_xxx flag 2011-10-24 03:20:53 +00:00
Kconfig iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
Makefile iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
target_core_alua.c target: Remove unneeded version.h includes 2011-10-11 04:10:19 +00:00
target_core_alua.h
target_core_cdb.c target: simplify target_parse_naa_6h_vendor_specific() 2011-10-24 03:20:41 +00:00
target_core_configfs.c target: Remove unneeded version.h includes 2011-10-11 04:10:19 +00:00
target_core_device.c target: Convert acl_node_lock to be IRQ-disabling 2011-08-22 19:28:36 +00:00
target_core_fabric_configfs.c target: Remove unneeded version.h includes 2011-10-11 04:10:19 +00:00
target_core_fabric_lib.c target: remove custom hex2bin() implementation 2011-07-22 09:37:49 +00:00
target_core_file.c target: Remove unneeded version.h includes 2011-10-11 04:10:19 +00:00
target_core_file.h target: Follow up core updates from AGrover and HCH (round 4) 2011-07-22 09:37:48 +00:00
target_core_hba.c target: Follow up core updates from AGrover and HCH (round 4) 2011-07-22 09:37:48 +00:00
target_core_hba.h
target_core_iblock.c target: cleanup iblock bio submission 2011-10-24 03:20:43 +00:00
target_core_iblock.h target: cleanup iblock bio submission 2011-10-24 03:20:43 +00:00
target_core_pr.c target: Remove unneeded version.h includes 2011-10-11 04:10:19 +00:00
target_core_pr.h target: Core cleanups from AGrover (round 1) 2011-07-22 09:37:43 +00:00
target_core_pscsi.c target: Make pscsi_create_virtdevice use ERR_CAST 2011-10-24 03:20:51 +00:00
target_core_pscsi.h target: cleanup pscsi request submission 2011-10-24 03:20:44 +00:00
target_core_rd.c target: Remove unneeded version.h includes 2011-10-11 04:10:19 +00:00
target_core_rd.h target: Follow up core updates from AGrover and HCH (round 4) 2011-07-22 09:37:48 +00:00
target_core_scdb.c target: Pass 2nd param of transport_split_cdb by value 2011-07-22 09:37:48 +00:00
target_core_scdb.h target: Pass 2nd param of transport_split_cdb by value 2011-07-22 09:37:48 +00:00
target_core_stat.c target: Remove unneeded version.h includes 2011-10-11 04:10:19 +00:00
target_core_stat.h [SCSI] target: add initial statistics 2011-03-23 11:36:50 -05:00
target_core_tmr.c target: Merge transport_cmd_finish_abort_tmr into transport_cmd_finish_abort 2011-10-24 03:20:58 +00:00
target_core_tpg.c target: Convert acl_node_lock to be IRQ-disabling 2011-08-22 19:28:36 +00:00
target_core_transport.c target: Remove legacy + unused device active I/O shutdown code 2011-10-24 03:20:59 +00:00
target_core_ua.c target: Remove unneeded version.h includes 2011-10-11 04:10:19 +00:00
target_core_ua.h