kernel.git/drivers/target/target_core_xcopy.c, branch linux-5.10.y

scsi: target: Fix XCOPY NAA identifier lookup

2021-01-12T19:18:27Z

commit 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 upstream. When attempting to match EXTENDED COPY CSCD descriptors with corresponding se_devices, target_xcopy_locate_se_dev_e4() currently iterates over LIO's global devices list which includes all configured backstores. This change ensures that only initiator-accessible backstores are considered during CSCD descriptor lookup, according to the session's se_node_acl LUN list. To avoid LUN removal race conditions, device pinning is changed from being configfs based to instead using the se_node_acl lun_ref. Reference: CVE-2020-28374 Fixes: cbf031f425fd ("target: Add support for EXTENDED_COPY copy offload emulation") Reviewed-by: Lee Duncan Signed-off-by: David Disseldorp Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman

scsi: target: Fix xcopy sess release leak

2020-07-08T04:14:34Z

transport_init_session can allocate memory via percpu_ref_init, and target_xcopy_release_pt never frees it. This adds a transport_uninit_session function to handle cleanup of resources allocated in the init function. Link: https://lore.kernel.org/r/1593654203-12442-3-git-send-email-michael.christie@oracle.com Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen

scsi: target: Rename target_setup_cmd_from_cdb() to target_cmd_parse_cdb()

2020-06-10T01:57:26Z

This commit also removes the unused argument, cdb, that was passed to this function. Link: https://lore.kernel.org/r/1591559913-8388-5-git-send-email-sudhakar.panneerselvam@oracle.com Reviewed-by: Mike Christie Signed-off-by: Sudhakar Panneerselvam Signed-off-by: Martin K. Petersen

scsi: target: Fix NULL pointer dereference

2020-06-10T01:57:26Z

NULL pointer dereference happens when the following conditions are met: 1) A SCSI command is received for a non-existing LU or cdb initialization fails in target_setup_cmd_from_cdb(). 2) Tracing is enabled. The following call sequences lead to NULL pointer dereference: 1) iscsit_setup_scsi_cmd transport_lookup_cmd_lun <-- lookup fails. or target_setup_cmd_from_cdb() <-- cdb initialization fails iscsit_process_scsi_cmd iscsit_sequence_cmd transport_send_check_condition_and_sense trace_target_cmd_complete <-- NULL dereference 2) target_submit_cmd_map_sgls transport_lookup_cmd_lun <-- lookup fails or target_setup_cmd_from_cdb() <-- cdb initialization fails transport_send_check_condition_and_sense trace_target_cmd_complete <-- NULL dereference In the above sequence, cmd->t_task_cdb is uninitialized which when referenced in trace_target_cmd_complete() causes NULL pointer dereference. The fix is to use the helper, target_cmd_init_cdb() and call it after transport_init_se_cmd() is called, so that cmd->t_task_cdb can be initialized and hence can be referenced in trace_target_cmd_complete(). Link: https://lore.kernel.org/r/1591559913-8388-4-git-send-email-sudhakar.panneerselvam@oracle.com Reviewed-by: Mike Christie Signed-off-by: Sudhakar Panneerselvam Signed-off-by: Martin K. Petersen

scsi: target: Initialize LUN in transport_init_se_cmd()

2020-06-10T01:57:26Z

Initialization of orig_fe_lun is moved to transport_init_se_cmd() from transport_lookup_cmd_lun(). This helps for the cases where the SCSI request fails before the call to transport_lookup_cmd_lun() so that trace_target_cmd_complete() can print the LUN information to the trace buffer. Due to this change, the lun parameter is removed from transport_lookup_cmd_lun() and transport_lookup_tmr_lun(). Link: https://lore.kernel.org/r/1591559913-8388-3-git-send-email-sudhakar.panneerselvam@oracle.com Reviewed-by: Mike Christie Signed-off-by: Sudhakar Panneerselvam Signed-off-by: Martin K. Petersen

scsi: target: use the stack for XCOPY passthrough cmds

2020-03-29T22:10:59Z

Reads and writes in the XCOPY loop are synchronous, so needn't be heap allocated / freed with each loop. Link: https://lore.kernel.org/r/20200327141954.955-6-ddiss@suse.de Reviewed-by: Christoph Hellwig Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen

scsi: target: avoid per-loop XCOPY buffer allocations

2020-03-29T22:10:59Z

The main target_xcopy_do_work() loop unnecessarily allocates an I/O buffer with each synchronous READ / WRITE pair. This commit significantly reduces allocations by reusing the XCOPY I/O buffer when possible. Link: https://lore.kernel.org/r/20200327141954.955-4-ddiss@suse.de Reviewed-by: Christoph Hellwig Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen

scsi: target: drop xcopy DISK BLOCK LENGTH debug

2020-03-29T22:10:59Z

The DISK BLOCK LENGTH field is carried with XCOPY target descriptors on the wire, but is currently unmarshalled during 0x02 segment descriptor passing. The unmarshalled value is currently unused, so drop it. Link: https://lore.kernel.org/r/20200327141954.955-3-ddiss@suse.de Reviewed-by: Christoph Hellwig Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen

scsi: target: use #define for xcopy descriptor len

2020-03-29T22:10:59Z

Link: https://lore.kernel.org/r/20200327141954.955-2-ddiss@suse.de Reviewed-by: Christoph Hellwig Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen

scsi: target: Remove tpg_list and se_portal_group.se_tpg_node

2019-10-04T02:00:09Z

Maintaining tpg_list without ever iterating over it is not useful. Hence remove tpg_list. This patch does not change the behavior of the SCSI target code. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Link: https://lore.kernel.org/r/20190930232224.58980-1-bvanassche@acm.org Signed-off-by: Bart Van Assche Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen