| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220309030916.2932316-3-haowenchao@huawei.com>
Date: Tue, 8 Mar 2022 22:09:15 -0500
From: Wenchao Hao <haowenchao@...wei.com>
To: Mike Christie <michael.christie@...cle.com>,
Lee Duncan <lduncan@...e.com>, Chris Leech <cleech@...hat.com>,
"James E . J . Bottomley" <jejb@...ux.ibm.com>,
"Martin K . Petersen" <martin.petersen@...cle.com>,
<open-iscsi@...glegroups.com>, <linux-scsi@...r.kernel.org>,
<linux-kernel@...r.kernel.org>
CC: Wu Bo <wubo40@...wei.com>, Zhiqiang Liu <liuzhiqiang26@...wei.com>,
<linfeilong@...wei.com>, Wenchao Hao <haowenchao@...wei.com>
Subject: [PATCH v2 2/3] scsi:libiscsi: Add iscsi_cls_conn to sysfs after been initialized
iscsi_create_conn() would expose iscsi_cls_conn to sysfs, while the
initialization of iscsi_conn's dd_data is not ready now. When userspace
try to access an attribute such as connect's address, it might cause
a NULL pointer dereference.
So we should add iscsi_cls_conn to sysfs until it has been initialized.
Remove iscsi_create_conn() by hand since it is not used now.
Signed-off-by: Wenchao Hao <haowenchao@...wei.com>
Signed-off-by: Wu Bo <wubo40@...wei.com>
---
drivers/scsi/libiscsi.c | 13 ++++-
drivers/scsi/scsi_transport_iscsi.c | 76 -----------------------------
include/scsi/scsi_transport_iscsi.h | 2 -
3 files changed, 11 insertions(+), 80 deletions(-)
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 059dae8909ee..43f903bce0b8 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -3040,8 +3040,9 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
struct iscsi_conn *conn;
struct iscsi_cls_conn *cls_conn;
char *data;
+ int err;
- cls_conn = iscsi_create_conn(cls_session, sizeof(*conn) + dd_size,
+ cls_conn = iscsi_alloc_conn(cls_session, sizeof(*conn) + dd_size,
conn_idx);
if (!cls_conn)
return NULL;
@@ -3078,13 +3079,21 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
goto login_task_data_alloc_fail;
conn->login_task->data = conn->data = data;
+ err = iscsi_add_conn(cls_conn);
+ if (err)
+ goto login_task_add_dev_fail;
+
return cls_conn;
+login_task_add_dev_fail:
+ free_pages((unsigned long) conn->data,
+ get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
+
login_task_data_alloc_fail:
kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
sizeof(void*));
login_task_alloc_fail:
- iscsi_destroy_conn(cls_conn);
+ iscsi_free_conn(cls_conn);
return NULL;
}
EXPORT_SYMBOL_GPL(iscsi_conn_setup);
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 8e97c6f88359..ca724eed4f4d 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2447,82 +2447,6 @@ void iscsi_free_conn(struct iscsi_cls_conn *conn)
}
EXPORT_SYMBOL_GPL(iscsi_free_conn);
-/**
- * iscsi_create_conn - create iscsi class connection
- * @session: iscsi cls session
- * @dd_size: private driver data size
- * @cid: connection id
- *
- * This can be called from a LLD or iscsi_transport. The connection
- * is child of the session so cid must be unique for all connections
- * on the session.
- *
- * Since we do not support MCS, cid will normally be zero. In some cases
- * for software iscsi we could be trying to preallocate a connection struct
- * in which case there could be two connection structs and cid would be
- * non-zero.
- */
-struct iscsi_cls_conn *
-iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
-{
- struct iscsi_transport *transport = session->transport;
- struct iscsi_cls_conn *conn;
- unsigned long flags;
- int err;
-
- conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL);
- if (!conn)
- return NULL;
- if (dd_size)
- conn->dd_data = &conn[1];
-
- mutex_init(&conn->ep_mutex);
- INIT_LIST_HEAD(&conn->conn_list);
- INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn);
- conn->transport = transport;
- conn->cid = cid;
- conn->state = ISCSI_CONN_DOWN;
-
- /* this is released in the dev's release function */
- if (!get_device(&session->dev))
- goto free_conn;
-
- dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid);
- conn->dev.parent = &session->dev;
- conn->dev.release = iscsi_conn_release;
- err = device_register(&conn->dev);
- if (err) {
- iscsi_cls_session_printk(KERN_ERR, session, "could not "
- "register connection's dev\n");
- goto release_parent_ref;
- }
- err = transport_register_device(&conn->dev);
- if (err) {
- iscsi_cls_session_printk(KERN_ERR, session, "could not "
- "register transport's dev\n");
- goto release_conn_ref;
- }
-
- spin_lock_irqsave(&connlock, flags);
- list_add(&conn->conn_list, &connlist);
- spin_unlock_irqrestore(&connlock, flags);
-
- ISCSI_DBG_TRANS_CONN(conn, "Completed conn creation\n");
- return conn;
-
-release_conn_ref:
- device_unregister(&conn->dev);
- put_device(&session->dev);
- return NULL;
-release_parent_ref:
- put_device(&session->dev);
-free_conn:
- kfree(conn);
- return NULL;
-}
-
-EXPORT_SYMBOL_GPL(iscsi_create_conn);
-
/**
* iscsi_destroy_conn - destroy iscsi class connection
* @conn: iscsi cls session
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 346f65bc3861..505764942f5e 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -446,8 +446,6 @@ extern struct iscsi_cls_conn *iscsi_alloc_conn(struct iscsi_cls_session *sess,
extern int iscsi_add_conn(struct iscsi_cls_conn *conn);
extern void iscsi_remove_conn(struct iscsi_cls_conn *conn);
extern void iscsi_free_conn(struct iscsi_cls_conn *conn);
-extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
- int dd_size, uint32_t cid);
extern void iscsi_put_conn(struct iscsi_cls_conn *conn);
extern void iscsi_get_conn(struct iscsi_cls_conn *conn);
extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
--
2.32.0
Powered by blists - more mailing lists