Revision c8e22b7a1694bb8d025ea636816472739d859145 authored by Jiri Kosina on 04 April 2023, 19:23:42 UTC, committed by Martin K. Petersen on 12 April 2023, 01:11:39 UTC
This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure
has no components") and introduces proper handling of case where there are
no detected secondary components, but primary component (enumerated in
num_enclosures) does exist. That fix was originally proposed by Ding Hui
<dinghui@sangfor.com.cn>.

Completely ignoring devices that have one primary enclosure and no
secondary one results in ses_intf_add() bailing completely

	scsi 2:0:0:254: enclosure has no enumerated components
        scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such

even on valid configurations with 1 primary and 0 secondary enclosures as
below:

	# sg_ses /dev/sg0
	  3PARdata  SES               3321
	Supported diagnostic pages:
	  Supported Diagnostic Pages [sdp] [0x0]
	  Configuration (SES) [cf] [0x1]
	  Short Enclosure Status (SES) [ses] [0x8]
	# sg_ses -p cf /dev/sg0
	  3PARdata  SES               3321
	Configuration diagnostic page:
	  number of secondary subenclosures: 0
	  generation code: 0x0
	  enclosure descriptor list
	    Subenclosure identifier: 0 [primary]
	      relative ES process id: 0, number of ES processes: 1
	      number of type descriptor headers: 1
	      enclosure logical identifier (hex): 20000002ac02068d
	      enclosure vendor: 3PARdata  product: VV                rev: 3321
	  type descriptor header and text list
	    Element type: Unspecified, subenclosure id: 0
	      number of possible elements: 1

The changelog for the original fix follows

=====
We can get a crash when disconnecting the iSCSI session,
the call trace like this:

  [ffff00002a00fb70] kfree at ffff00000830e224
  [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4
  [ffff00002a00fbd0] device_del at ffff0000086b6a98
  [ffff00002a00fc50] device_unregister at ffff0000086b6d58
  [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c
  [ffff00002a00fca0] scsi_remove_device at ffff000008706134
  [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4
  [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0
  [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4
  [ffff00002a00fdb0] process_one_work at ffff00000810f35c
  [ffff00002a00fe00] worker_thread at ffff00000810f648
  [ffff00002a00fe70] kthread at ffff000008116e98

In ses_intf_add, components count could be 0, and kcalloc 0 size scomp,
but not saved in edev->component[i].scratch

In this situation, edev->component[0].scratch is an invalid pointer,
when kfree it in ses_intf_remove_enclosure, a crash like above would happen
The call trace also could be other random cases when kfree cannot catch
the invalid pointer

We should not use edev->component[] array when the components count is 0
We also need check index when use edev->component[] array in
ses_enclosure_data_process
=====

Reported-by: Michal Kolar <mich.k@seznam.cz>
Originally-by: Ding Hui <dinghui@sangfor.com.cn>
Cc: stable@vger.kernel.org
Fixes: 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components")
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2304042122270.29760@cbobk.fhfr.pm
Tested-by: Michal Kolar <mich.k@seznam.cz>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
1 parent 48b19b7
History
File Mode Size
damon
kasan
kfence
kmsan
Kconfig -rw-r--r-- 37.4 KB
Kconfig.debug -rw-r--r-- 10.0 KB
Makefile -rw-r--r-- 5.0 KB
backing-dev.c -rw-r--r-- 27.5 KB
balloon_compaction.c -rw-r--r-- 8.2 KB
bootmem_info.c -rw-r--r-- 3.4 KB
cma.c -rw-r--r-- 15.5 KB
cma.h -rw-r--r-- 1.4 KB
cma_debug.c -rw-r--r-- 4.5 KB
cma_sysfs.c -rw-r--r-- 2.4 KB
compaction.c -rw-r--r-- 84.4 KB
debug.c -rw-r--r-- 6.7 KB
debug_page_ref.c -rw-r--r-- 1.4 KB
debug_vm_pgtable.c -rw-r--r-- 40.0 KB
dmapool.c -rw-r--r-- 13.6 KB
early_ioremap.c -rw-r--r-- 6.7 KB
fadvise.c -rw-r--r-- 5.6 KB
failslab.c -rw-r--r-- 1.6 KB
filemap.c -rw-r--r-- 116.0 KB
folio-compat.c -rw-r--r-- 3.2 KB
frontswap.c -rw-r--r-- 7.9 KB
gup.c -rw-r--r-- 89.8 KB
gup_test.c -rw-r--r-- 8.9 KB
gup_test.h -rw-r--r-- 1.2 KB
highmem.c -rw-r--r-- 20.1 KB
hmm.c -rw-r--r-- 17.0 KB
huge_memory.c -rw-r--r-- 88.2 KB
hugetlb.c -rw-r--r-- 208.7 KB
hugetlb_cgroup.c -rw-r--r-- 24.7 KB
hugetlb_vmemmap.c -rw-r--r-- 16.8 KB
hugetlb_vmemmap.h -rw-r--r-- 1.6 KB
hwpoison-inject.c -rw-r--r-- 2.8 KB
init-mm.c -rw-r--r-- 1.7 KB
internal.h -rw-r--r-- 32.3 KB
interval_tree.c -rw-r--r-- 3.1 KB
io-mapping.c -rw-r--r-- 993 bytes
ioremap.c -rw-r--r-- 1.4 KB
khugepaged.c -rw-r--r-- 71.0 KB
kmemleak.c -rw-r--r-- 60.9 KB
ksm.c -rw-r--r-- 90.6 KB
list_lru.c -rw-r--r-- 13.8 KB
maccess.c -rw-r--r-- 5.8 KB
madvise.c -rw-r--r-- 38.8 KB
mapping_dirty_helpers.c -rw-r--r-- 10.5 KB
memblock.c -rw-r--r-- 61.5 KB
memcontrol.c -rw-r--r-- 201.6 KB
memfd.c -rw-r--r-- 9.7 KB
memory-failure.c -rw-r--r-- 70.0 KB
memory-tiers.c -rw-r--r-- 18.4 KB
memory.c -rw-r--r-- 159.5 KB
memory_hotplug.c -rw-r--r-- 64.0 KB
mempolicy.c -rw-r--r-- 78.4 KB
mempool.c -rw-r--r-- 16.1 KB
memremap.c -rw-r--r-- 15.0 KB
memtest.c -rw-r--r-- 2.8 KB
migrate.c -rw-r--r-- 69.1 KB
migrate_device.c -rw-r--r-- 27.4 KB
mincore.c -rw-r--r-- 7.1 KB
mlock.c -rw-r--r-- 19.3 KB
mm_init.c -rw-r--r-- 5.2 KB
mm_slot.h -rw-r--r-- 1.4 KB
mmap.c -rw-r--r-- 98.7 KB
mmap_lock.c -rw-r--r-- 6.2 KB
mmu_gather.c -rw-r--r-- 9.8 KB
mmu_notifier.c -rw-r--r-- 35.0 KB
mmzone.c -rw-r--r-- 2.5 KB
mprotect.c -rw-r--r-- 23.1 KB
mremap.c -rw-r--r-- 29.6 KB
msync.c -rw-r--r-- 2.9 KB
nommu.c -rw-r--r-- 44.3 KB
oom_kill.c -rw-r--r-- 33.5 KB
page-writeback.c -rw-r--r-- 95.1 KB
page_alloc.c -rw-r--r-- 271.1 KB
page_counter.c -rw-r--r-- 6.8 KB
page_ext.c -rw-r--r-- 13.7 KB
page_idle.c -rw-r--r-- 5.3 KB
page_io.c -rw-r--r-- 13.4 KB
page_isolation.c -rw-r--r-- 20.7 KB
page_owner.c -rw-r--r-- 18.0 KB
page_poison.c -rw-r--r-- 2.5 KB
page_reporting.c -rw-r--r-- 11.6 KB
page_reporting.h -rw-r--r-- 1.6 KB
page_table_check.c -rw-r--r-- 6.0 KB
page_vma_mapped.c -rw-r--r-- 8.7 KB
pagewalk.c -rw-r--r-- 16.3 KB
percpu-internal.h -rw-r--r-- 7.1 KB
percpu-km.c -rw-r--r-- 3.2 KB
percpu-stats.c -rw-r--r-- 5.8 KB
percpu-vm.c -rw-r--r-- 11.7 KB
percpu.c -rw-r--r-- 102.2 KB
pgalloc-track.h -rw-r--r-- 1.3 KB
pgtable-generic.c -rw-r--r-- 5.8 KB
process_vm_access.c -rw-r--r-- 8.2 KB
ptdump.c -rw-r--r-- 4.2 KB
readahead.c -rw-r--r-- 25.9 KB
rmap.c -rw-r--r-- 73.9 KB
rodata_test.c -rw-r--r-- 1.2 KB
secretmem.c -rw-r--r-- 6.4 KB
shmem.c -rw-r--r-- 113.4 KB
shrinker_debug.c -rw-r--r-- 6.2 KB
shuffle.c -rw-r--r-- 4.6 KB
shuffle.h -rw-r--r-- 1.2 KB
slab.c -rw-r--r-- 102.1 KB
slab.h -rw-r--r-- 23.8 KB
slab_common.c -rw-r--r-- 37.1 KB
slob.c -rw-r--r-- 18.8 KB
slub.c -rw-r--r-- 160.7 KB
sparse-vmemmap.c -rw-r--r-- 11.9 KB
sparse.c -rw-r--r-- 25.6 KB
swap.c -rw-r--r-- 30.8 KB
swap.h -rw-r--r-- 3.9 KB
swap_cgroup.c -rw-r--r-- 5.2 KB
swap_slots.c -rw-r--r-- 9.2 KB
swap_state.c -rw-r--r-- 23.8 KB
swapfile.c -rw-r--r-- 92.5 KB
truncate.c -rw-r--r-- 25.9 KB
usercopy.c -rw-r--r-- 8.1 KB
userfaultfd.c -rw-r--r-- 19.7 KB
util.c -rw-r--r-- 28.7 KB
vmalloc.c -rw-r--r-- 110.4 KB
vmpressure.c -rw-r--r-- 13.9 KB
vmscan.c -rw-r--r-- 220.5 KB
vmstat.c -rw-r--r-- 54.7 KB
workingset.c -rw-r--r-- 24.7 KB
z3fold.c -rw-r--r-- 43.8 KB
zbud.c -rw-r--r-- 17.8 KB
zpool.c -rw-r--r-- 11.4 KB
zsmalloc.c -rw-r--r-- 65.9 KB
zswap.c -rw-r--r-- 40.0 KB

back to top