linux-kernel - Re: [PATCH] vhost/scsi: Fix improper cleanup in vhost_scsi_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e@oracle.com>
Date: Tue, 14 Jan 2025 11:44:32 -0600
From: Mike Christie <michael.christie@...cle.com>
To: 张浩然 <wh1sper@....edu.cn>
Cc: mst@...hat.com, jasowang@...hat.com, pbonzini@...hat.com,
        stefanha@...hat.com, eperezma@...hat.com,
        virtualization@...ts.linux.dev, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] vhost/scsi: Fix improper cleanup in
 vhost_scsi_set_endpoint()

On 1/14/25 1:40 AM, 张浩然 wrote:
> After reevaluating the PoC, I realized that my initial claim was incorrect. The target WWN in the second vhost_scsi_set_endpoint() call is not the same as in the first one. Below is my targetcli status:
> 
> o- vhost ......................................... [Targets: 3]
>   | o- naa.500140501e23be28 ......................... [TPGs: 1]
>   | | o- tpg1 ............. [naa.50014058f7da10b7, no-gen-acls]
>   | |   o- acls ..................................... [ACLs: 0]
>   | |   o- luns ..................................... [LUNs: 0]
>   | o- naa.500140562c8936fa ......................... [TPGs: 2]
>   | | o- tpg1 ............. [naa.50014058d133f962, no-gen-acls]
>   | | | o- acls ..................................... [ACLs: 0]
>   | | | o- luns ..................................... [LUNs: 3]
>   | | |   o- lun0 ... [block/disk0 (/dev/disk/...) (default_tg_pt_gp)]
>   | | |   o- lun1 .... [fileio/vhost-fileio (/root/fileio-vhost) (default_tg_pt_gp)]
>   | | |   o- lun2 ............. [ramdisk/rd (default_tg_pt_gp)]
>   | | o- tpg2 ............. [naa.50014055c6fb4182, no-gen-acls]
>   | |   o- acls ..................................... [ACLs: 0]
>   | |   o- luns ..................................... [LUNs: 0]
> 
> The bug occurs when `naa.500140562c8936fa` has already been set as an endpoint, and I send a VHOST_SCSI_SET_ENDPOINT ioctl command with `naa.500140501e23be28`. The ioctl returns -1 EEXIST (File exists), and the kernel logs a BUG message in dmesg.

I see now and can replicate it. I think there is a 2nd bug in
vhost_scsi_set_endpoint related to all this where we need to
prevent switching targets like this or else we'll leak some
other refcounts. If 500140501e23be28's tpg number was 3 then
we would overwrite the existing vs->vs_vhost_wwpn and never
be able to release the refounts on the tpgs from 500140562c8936fa.
 
I'll send a patchset to fix everything and cc you.

Thanks for all the work you did testing and debugging this
issue.