kernel.git/drivers/target/target_core_pr.c, branch linux-5.10.y

scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()

2025-07-17T16:27:48Z

[ Upstream commit d8ab68bdb294b09a761e967dad374f2965e1913f ] The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com Reviewed-by: Mike Christie Reviewed-by: John Meneghini Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: target: core: Prevent underflow for service actions

2021-03-17T16:06:26Z

[ Upstream commit 14d24e2cc77411301e906a8cf41884739de192de ] TCM buffer length doesn't necessarily equal 8 + ADDITIONAL LENGTH which might be considered an underflow in case of Data-In size being greater than 8 + ADDITIONAL LENGTH. So truncate buffer length to prevent underflow. Link: https://lore.kernel.org/r/20210209072202.41154-3-a.miloserdov@yadro.com Reviewed-by: Roman Bolshakov Reviewed-by: Bodo Stroesser Signed-off-by: Aleksandr Miloserdov Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

treewide: Use fallthrough pseudo-keyword

2020-08-23T22:36:59Z

Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary fall-through markings when it is the case. [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva

scsi: target: Remove unused variable 'tpg'

2020-07-14T03:11:15Z

Gcc reports warning as follows: drivers/target/target_core_pr.c:1162:26: warning: variable 'tpg' set but not used [-Wunused-but-set-variable] 1162 | struct se_portal_group *tpg; | ^~~ After commit 63c9ffe473d3 ("scsi: target: Check enforce_pr_isids during registration"), 'tpg' is never used. Remove it to avoid build warning. Link: https://lore.kernel.org/r/20200709114636.69256-1-weiyongjun1@huawei.com Reported-by: Hulk Robot Reviewed-by: Chaitanya Kulkarni Reviewed-by: Himanshu Madhani Reviewed-by: Mike Christie Signed-off-by: Wei Yongjun Signed-off-by: Martin K. Petersen

scsi: target: Fix crash during SPEC_I_PT handling

2020-07-08T04:14:34Z

__core_scsi3_add_registration clears the t10_pr_registration pr_reg_deve and does a core_scsi3_lunacl_undepend_item which does an undepend and also does a kref_put from the get done in __core_scsi3_alloc_registration. So when we get to the bottom of core_scsi3_decode_spec_i_port the pr_reg_deve is NULL and we crash when trying to access the local_pr_reg's pr_reg_deve. We've also done an extra undepend for local_pr_reg and if we didn't crash on the NULL we would have done an extra kref_put too. This patch has us do a core_scsi3_lunacl_depend_item for local_pr_reg and then let __core_scsi3_add_registration handle the cleanup for the pr_reg_deve. We then just skip the undepend for the acl and tpg for the local pr_reg. The error path then works in a similar way, but we always do the core_scsi3_lunacl_undepend_item since we never call __core_scsi3_add_registration in that code path. Link: https://lore.kernel.org/r/1593654203-12442-4-git-send-email-michael.christie@oracle.com Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen

scsi: target: Check enforce_pr_isids during registration

2020-07-08T04:14:21Z

Move the check for enforce_pr_isids to the registration code where we can fail at the time an initiator tries to register a path without an isid. In its current place in __core_scsi3_locate_pr_reg, it is too late because it can be registered and be reported in PR in commands and it is stuck in this state because we cannot unregister it. [mkp: applied by hand] Link: https://lore.kernel.org/r/1593654203-12442-2-git-send-email-michael.christie@oracle.com Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen

scsi: target: Make transport_flags per device

2020-05-08T02:39:21Z

pgr_support and alua_support device attributes show the inverted value of the transport_flags: * TRANSPORT_FLAG_PASSTHROUGH_PGR * TRANSPORT_FLAG_PASSTHROUGH_ALUA These attributes are per device, while the flags are per backend. Rename the transport_flags in backend/transport to transport_flags_default and use this value to initialize the new transport_flags field in the se_device structure. Now data and attribute both are per se_device. Link: https://lore.kernel.org/r/20200427150823.15350-4-bstroesser@ts.fujitsu.com Reviewed-by: Mike Christie Signed-off-by: Bodo Stroesser Signed-off-by: Martin K. Petersen

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156

2019-05-30T18:26:35Z

Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not write to the free software foundation inc 59 temple place suite 330 boston ma 02111 1307 usa extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 1334 file(s). Signed-off-by: Thomas Gleixner Reviewed-by: Allison Randal Reviewed-by: Richard Fontana Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de Signed-off-by: Greg Kroah-Hartman

scsi: target/core: Rework the SPC-2 reservation handling code

2019-04-13T00:20:05Z

Instead of tracking the initiator that established an SPC-2 reservation, track the session through which the SPC-2 reservation has been established. This patch does not change any functionality. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen

scsi: target/iscsi: Convert comments about locking into runtime checks

2019-02-05T02:33:08Z

Cc: Nicholas Bellinger Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen