linux-kernel - Re: [-next] BUG_ON in scsi_target

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 14 Apr 2016 11:07:52 +0900
From:	Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
To:	James Bottomley <jejb@...ux.vnet.ibm.com>
Cc:	Johannes Thumshirn <jthumshirn@...e.de>,
	Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>,
	"Ewan D. Milne" <emilne@...hat.com>,
	Hannes Reinecke <hare@...e.com>,
	"Martin K. Petersen" <martin.petersen@...cle.com>,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-usb@...r.kernel.org, linux-next@...r.kernel.org,
	Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
	Xiong Zhou <jencce.kernel@...il.com>
Subject: Re: [-next] BUG_ON in scsi_target_destroy()

Hello,

On (04/13/16 08:14), James Bottomley wrote:
[..]
> How about good grief no!  A device with multiple targets will get it's
> lists screwed with this
> 
> The STARGET_REMOVE state you added only applies to the case we're
> trying to kill a target.  In the natural operation case, which is what
> everyone else is running into, we will try to remove a running target
> when it has no more scsi devices left on it.  So the correct patch
> should be to make the BUG_ON see this:

works for me.
Reported-and-tested-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>

	-ss

> James
> 
> ---
> 
> diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
> index 27df7e7..e0a78f5 100644
> --- a/drivers/scsi/scsi_scan.c
> +++ b/drivers/scsi/scsi_scan.c
> @@ -319,8 +319,7 @@ static void scsi_target_destroy(struct scsi_target *starget)
>  	struct Scsi_Host *shost = dev_to_shost(dev->parent);
>  	unsigned long flags;
>  
> -	BUG_ON(starget->state != STARGET_REMOVE &&
> -	       starget->state != STARGET_CREATED);
> +	BUG_ON(starget->state == STARGET_DEL);
>  	starget->state = STARGET_DEL;
>  	transport_destroy_device(dev);
>  	spin_lock_irqsave(shost->host_lock, flags);
>