lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 10 Apr 2016 11:36:45 -0700 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org, Himanshu Madhani <himanshu.madhani@...gic.com>, Nicholas Bellinger <nab@...ux-iscsi.org> Subject: [PATCH 4.4 184/210] target: Fix target_release_cmd_kref shutdown comp leak 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Himanshu Madhani <himanshu.madhani@...gic.com> commit 5e47f1985d7107331c3f64fb3ec83d66fd73577e upstream. This patch fixes an active I/O shutdown bug for fabric drivers using target_wait_for_sess_cmds(), where se_cmd descriptor shutdown would result in hung tasks waiting indefinitely for se_cmd->cmd_wait_comp to complete(). To address this bug, drop the incorrect list_del_init() usage in target_wait_for_sess_cmds() and always complete() during se_cmd target_release_cmd_kref() put, in order to let caller invoke the final fabric release callback into se_cmd->se_tfo->release_cmd() code. Reported-by: Himanshu Madhani <himanshu.madhani@...gic.com> Tested-by: Himanshu Madhani <himanshu.madhani@...gic.com> Signed-off-by: Himanshu Madhani <himanshu.madhani@...gic.com> Signed-off-by: Nicholas Bellinger <nab@...ux-iscsi.org> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> --- drivers/target/target_core_transport.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -2618,8 +2618,6 @@ void target_wait_for_sess_cmds(struct se list_for_each_entry_safe(se_cmd, tmp_cmd, &se_sess->sess_wait_list, se_cmd_list) { - list_del_init(&se_cmd->se_cmd_list); - pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:" " %d\n", se_cmd, se_cmd->t_state, se_cmd->se_tfo->get_cmd_state(se_cmd));
Powered by blists - more mailing lists