lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 18 Jan 2013 17:16:43 -0800 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, alan@...rguk.ukuu.org.uk, Sebastian Andrzej Siewior <bigeasy@...utronix.de>, Nicholas Bellinger <nab@...ux-iscsi.org>, CAI Qian <caiqian@...hat.com> Subject: [ 18/33] target: Add link_magic for fabric allow_link destination target_items 3.7-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nicholas Bellinger <nab@...ux-iscsi.org> commit 0ff8754981261a80f4b77db2536dfea92c2d4539 upstream. This patch adds [dev,lun]_link_magic value assignment + checks within generic target_fabric_port_link() and target_fabric_mappedlun_link() code to ensure destination config_item *target_item sent from configfs_symlink() -> config_item_operations->allow_link() is the underlying se_device->dev_group and se_lun->lun_group that we expect to symlink. Reported-by: Sebastian Andrzej Siewior <bigeasy@...utronix.de> Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de> Signed-off-by: Nicholas Bellinger <nab@...ux-iscsi.org> Signed-off-by: CAI Qian <caiqian@...hat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> --- drivers/target/target_core_device.c | 1 + drivers/target/target_core_fabric_configfs.c | 12 ++++++++++++ drivers/target/target_core_tpg.c | 1 + drivers/target/target_core_transport.c | 1 + include/target/target_core_base.h | 4 ++++ 5 files changed, 19 insertions(+) --- a/drivers/target/target_core_device.c +++ b/drivers/target/target_core_device.c @@ -1624,6 +1624,7 @@ int core_dev_setup_virtual_lun0(void) ret = PTR_ERR(dev); goto out; } + dev->dev_link_magic = SE_DEV_LINK_MAGIC; se_dev->se_dev_ptr = dev; g_lun0_dev = dev; --- a/drivers/target/target_core_fabric_configfs.c +++ b/drivers/target/target_core_fabric_configfs.c @@ -71,6 +71,12 @@ static int target_fabric_mappedlun_link( struct se_portal_group *se_tpg; struct config_item *nacl_ci, *tpg_ci, *tpg_ci_s, *wwn_ci, *wwn_ci_s; int ret = 0, lun_access; + + if (lun->lun_link_magic != SE_LUN_LINK_MAGIC) { + pr_err("Bad lun->lun_link_magic, not a valid lun_ci pointer:" + " %p to struct lun: %p\n", lun_ci, lun); + return -EFAULT; + } /* * Ensure that the source port exists */ @@ -745,6 +751,12 @@ static int target_fabric_port_link( struct target_fabric_configfs *tf; int ret; + if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) { + pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:" + " %p to struct se_device: %p\n", se_dev_ci, dev); + return -EFAULT; + } + tpg_ci = &lun_ci->ci_parent->ci_group->cg_item; se_tpg = container_of(to_config_group(tpg_ci), struct se_portal_group, tpg_group); --- a/drivers/target/target_core_tpg.c +++ b/drivers/target/target_core_tpg.c @@ -672,6 +672,7 @@ int core_tpg_register( for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) { lun = se_tpg->tpg_lun_list[i]; lun->unpacked_lun = i; + lun->lun_link_magic = SE_LUN_LINK_MAGIC; lun->lun_status = TRANSPORT_LUN_STATUS_FREE; atomic_set(&lun->lun_acl_count, 0); init_completion(&lun->lun_shutdown_comp); --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1071,6 +1071,7 @@ struct se_device *transport_add_device_t dev->se_hba = hba; dev->se_sub_dev = se_dev; dev->transport = transport; + dev->dev_link_magic = SE_DEV_LINK_MAGIC; INIT_LIST_HEAD(&dev->dev_list); INIT_LIST_HEAD(&dev->dev_sep_list); INIT_LIST_HEAD(&dev->dev_tmr_list); --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h @@ -734,6 +734,8 @@ struct se_subsystem_dev { }; struct se_device { +#define SE_DEV_LINK_MAGIC 0xfeeddeef + u32 dev_link_magic; /* RELATIVE TARGET PORT IDENTIFER Counter */ u16 dev_rpti_counter; /* Used for SAM Task Attribute ordering */ @@ -820,6 +822,8 @@ struct se_port_stat_grps { }; struct se_lun { +#define SE_LUN_LINK_MAGIC 0xffff7771 + u32 lun_link_magic; /* See transport_lun_status_table */ enum transport_lun_status_table lun_status; u32 lun_access; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists