All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 4.14 1/6] scsi: target: iscsi: Prevent login threads from racing between each other
@ 2023-06-15 11:40 Sasha Levin
  2023-06-15 11:40 ` [PATCH AUTOSEL 4.14 2/6] HID: wacom: Add error check to wacom_parse_and_register() Sasha Levin
                   ` (4 more replies)
  0 siblings, 5 replies; 13+ messages in thread
From: Sasha Levin @ 2023-06-15 11:40 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Maurizio Lombardi, Mike Christie, Martin K . Petersen,
	Sasha Levin, d.bogdanov, peilin.ye, yang.lee, linux-scsi,
	target-devel

From: Maurizio Lombardi <mlombard@redhat.com>

[ Upstream commit 2a737d3b8c792400118d6cf94958f559de9c5e59 ]

The tpg->np_login_sem is a semaphore that is used to serialize the login
process when multiple login threads run concurrently against the same
target portal group.

The iscsi_target_locate_portal() function finds the tpg, calls
iscsit_access_np() against the np_login_sem semaphore and saves the tpg
pointer in conn->tpg;

If iscsi_target_locate_portal() fails, the caller will check for the
conn->tpg pointer and, if it's not NULL, then it will assume that
iscsi_target_locate_portal() called iscsit_access_np() on the semaphore.

Make sure that conn->tpg gets initialized only if iscsit_access_np() was
successful, otherwise iscsit_deaccess_np() may end up being called against
a semaphore we never took, allowing more than one thread to access the same
tpg.

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Link: https://lore.kernel.org/r/20230508162219.1731964-4-mlombard@redhat.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/iscsi/iscsi_target_nego.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 07335357418c8..d94f711afee07 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -1067,6 +1067,7 @@ int iscsi_target_locate_portal(
 	iscsi_target_set_sock_callbacks(conn);
 
 	login->np = np;
+	conn->tpg = NULL;
 
 	login_req = (struct iscsi_login_req *) login->req;
 	payload_length = ntoh24(login_req->dlength);
@@ -1136,7 +1137,6 @@ int iscsi_target_locate_portal(
 	 */
 	sessiontype = strncmp(s_buf, DISCOVERY, 9);
 	if (!sessiontype) {
-		conn->tpg = iscsit_global->discovery_tpg;
 		if (!login->leading_connection)
 			goto get_target;
 
@@ -1153,9 +1153,11 @@ int iscsi_target_locate_portal(
 		 * Serialize access across the discovery struct iscsi_portal_group to
 		 * process login attempt.
 		 */
+		conn->tpg = iscsit_global->discovery_tpg;
 		if (iscsit_access_np(np, conn->tpg) < 0) {
 			iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
 				ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE);
+			conn->tpg = NULL;
 			ret = -1;
 			goto out;
 		}
-- 
2.39.2


^ permalink raw reply related	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2023-06-16 19:45 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-06-15 11:40 [PATCH AUTOSEL 4.14 1/6] scsi: target: iscsi: Prevent login threads from racing between each other Sasha Levin
2023-06-15 11:40 ` [PATCH AUTOSEL 4.14 2/6] HID: wacom: Add error check to wacom_parse_and_register() Sasha Levin
2023-06-15 11:40 ` [PATCH AUTOSEL 4.14 3/6] arm64: Add missing Set/Way CMO encodings Sasha Levin
2023-06-15 11:40   ` Sasha Levin
2023-06-16 19:34   ` Pavel Machek
2023-06-16 19:34     ` Pavel Machek
2023-06-15 11:40 ` [PATCH AUTOSEL 4.14 4/6] nfcsim.c: Fix error checking for debugfs_create_dir Sasha Levin
2023-06-16 19:35   ` Pavel Machek
2023-06-15 11:40 ` [PATCH AUTOSEL 4.14 5/6] fbdev: imsttfb: Release framebuffer and dealloc cmap on error path Sasha Levin
2023-06-15 11:40   ` Sasha Levin
2023-06-16 19:36   ` Pavel Machek
2023-06-16 19:36     ` Pavel Machek
2023-06-15 11:40 ` [PATCH AUTOSEL 4.14 6/6] usb: gadget: udc: fix NULL dereference in remove() Sasha Levin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.