linux-kernel - Re: [PATCH] target: Fix a double put in transport_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f03c8a67-d015-d503-726b-647b4f327b25@redhat.com>
Date:   Fri, 26 Mar 2021 13:31:39 +0100
From:   Maurizio Lombardi <mlombard@...hat.com>
To:     Lv Yunlong <lyl2019@...l.ustc.edu.cn>, martin.petersen@...cle.com
Cc:     linux-scsi@...r.kernel.org, target-devel@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] target: Fix a double put in transport_free_session



Dne 23. 03. 21 v 3:58 Lv Yunlong napsal(a):
> In transport_free_session, se_nacl is got from se_sess
> with the initial reference. If se_nacl->acl_sess_list is
> empty, se_nacl->dynamic_stop is set to true. Then the first
> target_put_nacl(se_nacl) will drop the initial reference
> and free se_nacl. Later there is a second target_put_nacl()
> to put se_nacl. It may cause error in race.
> 
> My patch sets se_nacl->dynamic_stop to false to avoid the
> double put.
> 
> Signed-off-by: Lv Yunlong <lyl2019@...l.ustc.edu.cn>
> ---
>  drivers/target/target_core_transport.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index 5ecb9f18a53d..c266defe694f 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -584,8 +584,10 @@ void transport_free_session(struct se_session *se_sess)
>  		}
>  		mutex_unlock(&se_tpg->acl_node_mutex);
>  
> -		if (se_nacl->dynamic_stop)
> +		if (se_nacl->dynamic_stop) {
>  			target_put_nacl(se_nacl);
> +			se_nacl->dynamic_stop = false;
> +		}
>  
>  		target_put_nacl(se_nacl);
>  	}
> 

FYI,

I have received a bug report against the 5.8 kernel about task hangs that seems to involve the nacl "dynamic_stop" code

Mar  4 16:49:44 gzboot kernel: [186322.177819] INFO: task targetcli:2359053 blocked for more than 120 seconds.
Mar  4 16:49:44 gzboot kernel: [186322.178862]       Tainted: P           O      5.8.0-44-generic #50-Ubuntu
Mar  4 16:49:44 gzboot kernel: [186322.179746] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Mar  4 16:49:44 gzboot kernel: [186322.180583] targetcli       D    0 2359053 2359052 0x00000000
Mar  4 16:49:44 gzboot kernel: [186322.180586] Call Trace:
Mar  4 16:49:44 gzboot kernel: [186322.180592]  __schedule+0x212/0x5d0
Mar  4 16:49:44 gzboot kernel: [186322.180595]  ? usleep_range+0x90/0x90
Mar  4 16:49:44 gzboot kernel: [186322.180596]  schedule+0x55/0xc0
Mar  4 16:49:44 gzboot kernel: [186322.180597]  schedule_timeout+0x10f/0x160
Mar  4 16:49:44 gzboot kernel: [186322.180601]  ? evict+0x14c/0x1b0
Mar  4 16:49:44 gzboot kernel: [186322.180602]  __wait_for_common+0xa8/0x150
Mar  4 16:49:44 gzboot kernel: [186322.180603]  wait_for_completion+0x24/0x30
Mar  4 16:49:44 gzboot kernel: [186322.180637]  core_tpg_del_initiator_node_acl+0x8e/0x120 [target_core_mod]
Mar  4 16:49:44 gzboot kernel: [186322.180643]  target_fabric_nacl_base_release+0x26/0x30 [target_core_mod]
Mar  4 16:49:44 gzboot kernel: [186322.180647]  config_item_cleanup+0x5d/0xf0
Mar  4 16:49:44 gzboot kernel: [186322.180649]  config_item_put+0x2d/0x40
Mar  4 16:49:44 gzboot kernel: [186322.180651]  configfs_rmdir+0x1d8/0x350
Mar  4 16:49:44 gzboot kernel: [186322.180653]  vfs_rmdir.part.0+0x66/0x190
Mar  4 16:49:44 gzboot kernel: [186322.180654]  do_rmdir+0x1b4/0x200
Mar  4 16:49:44 gzboot kernel: [186322.180655]  __x64_sys_rmdir+0x17/0x20
Mar  4 16:49:44 gzboot kernel: [186322.180657]  do_syscall_64+0x49/0xc0
Mar  4 16:49:44 gzboot kernel: [186322.180659]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
Mar  4 16:49:44 gzboot kernel: [186322.180660] RIP: 0033:0x7f30cf1ca9eb
Mar  4 16:49:44 gzboot kernel: [186322.180661] RSP: 002b:00007ffd72030bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
Mar  4 16:49:44 gzboot kernel: [186322.180662] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00007f30cf1ca9eb
Mar  4 16:49:44 gzboot kernel: [186322.180663] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f30cc1e2a50
Mar  4 16:49:44 gzboot kernel: [186322.180664] RBP: 0000000000a4b7a0 R08: 0000000000000000 R09: 00007ffd72030b7f
Mar  4 16:49:44 gzboot kernel: [186322.180664] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd72030c00
Mar  4 16:49:44 gzboot kernel: [186322.180665] R13: 00007f30cdd706a8 R14: 00007f30ced00cc0 R15: 00007f30cdd70698


Maurizio