https://github.com/torvalds/linux
Revision 057085e522f8bf94c2e691a5b76880f68060f8ba authored by Nicholas Bellinger on 06 November 2015, 07:37:59 UTC, committed by Nicholas Bellinger on 29 November 2015, 03:33:15 UTC
This patch addresses a race + use after free where the first stage of COMPARE_AND_WRITE in compare_and_write_callback() is rescheduled after the backend sends the secondary WRITE, resulting in second stage compare_and_write_post() callback completing in target_complete_ok_work() before the first can return. Because current code depends on checking se_cmd->se_cmd_flags after return from se_cmd->transport_complete_callback(), this results in first stage having SCF_COMPARE_AND_WRITE_POST set, which incorrectly falls through into second stage CAW processing code, eventually triggering a NULL pointer dereference due to use after free. To address this bug, pass in a new *post_ret parameter into se_cmd->transport_complete_callback(), and depend upon this value instead of ->se_cmd_flags to determine when to return or fall through into ->queue_status() code for CAW. Cc: Sagi Grimberg <sagig@mellanox.com> Cc: <stable@vger.kernel.org> # v3.12+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
1 parent ca82c2b
Tip revision: 057085e522f8bf94c2e691a5b76880f68060f8ba authored by Nicholas Bellinger on 06 November 2015, 07:37:59 UTC
target: Fix race for SCF_COMPARE_AND_WRITE_POST checking
target: Fix race for SCF_COMPARE_AND_WRITE_POST checking
Tip revision: 057085e
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .get_maintainer.ignore | -rw-r--r-- | 31 bytes |
| .gitignore | -rw-r--r-- | 1.2 KB |
| .mailmap | -rw-r--r-- | 5.4 KB |
| COPYING | -rw-r--r-- | 18.3 KB |
| CREDITS | -rw-r--r-- | 94.9 KB |
| Kbuild | -rw-r--r-- | 2.6 KB |
| Kconfig | -rw-r--r-- | 252 bytes |
| MAINTAINERS | -rw-r--r-- | 328.3 KB |
| Makefile | -rw-r--r-- | 53.5 KB |
| README | -rw-r--r-- | 18.2 KB |
| REPORTING-BUGS | -rw-r--r-- | 7.3 KB |
Computing file changes ...
