[PATCH v2] scsi: target: tcm_loop: Fix NULL ptr dereference

[PATCH v2] scsi: target: tcm_loop: Fix NULL ptr dereference

[Guixin Liu]

The TCM_LOOP LUN creation process calls device_register() to create the
device, which in turn invokes tcm_loop_driver_probe() registered with
the TCM_LOOP bus to create and register the scsi_host.
However, if the scsi_host memory allocation fails or scsi_add_host()
fails, the device_register() process still returns success.
Subsequently, when the user binds the LUN to a specific backend device,
it accesses the NULL or freed scsi_host.

Crash Call Trace:
  RIP: 0010:scsi_is_host_device+0x7/0x20
  scsi_alloc_target+0x32/0x2c0
  __scsi_add_device+0x41/0xf0
  scsi_add_device+0xd/0x30
  tcm_loop_port_link+0x25/0x50 [tcm_loop]
  target_fabric_port_link+0x9c/0xb0 [target_core_mod]
  ...

This issue is fixed by:
  1. Setting the tcm_loop_hba's scsi_host to NULL, if
     scsi_add_host() fails.
  2. Checking the tcm_loop_hba's scsi_host after device_register().
  3. Checking the tcm_loop_hba's scsi_host in tcm_loop_driver_remove().

Fixes: 3703b2c5d041 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
v1 -> v2:
1. Unregister the device if scsi_host is NULL.
2. Check NULL in tcm_loop_driver_remove().
 drivers/target/loopback/tcm_loop.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 528883d989b8..757158094198 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -393,6 +393,7 @@ static int tcm_loop_driver_probe(struct device *dev)
 	if (error) {
 		pr_err("%s: scsi_add_host failed\n", __func__);
 		scsi_host_put(sh);
+		tl_hba->sh = NULL;
 		return -ENODEV;
 	}
 	return 0;
@@ -406,8 +407,10 @@ static void tcm_loop_driver_remove(struct device *dev)
 	tl_hba = to_tcm_loop_hba(dev);
 	sh = tl_hba->sh;
 
-	scsi_remove_host(sh);
-	scsi_host_put(sh);
+	if (sh) {
+		scsi_remove_host(sh);
+		scsi_host_put(sh);
+	}
 }
 
 static void tcm_loop_release_adapter(struct device *dev)
@@ -436,6 +439,11 @@ static int tcm_loop_setup_hba_bus(struct tcm_loop_hba *tl_hba, int tcm_loop_host
 		return -ENODEV;
 	}
 
+	if (!tl_hba->sh) {
+		device_unregister(&tl_hba->dev);
+		return -ENODEV;
+	}
+
 	return 0;
 }
 
-- 
2.32.0.3.g01195cf9f

Re: [PATCH v2] scsi: target: tcm_loop: Fix NULL ptr dereference

[Mike Christie]

On 4/23/26 8:39 PM, Guixin Liu wrote:
> The TCM_LOOP LUN creation process calls device_register() to create the
> device, which in turn invokes tcm_loop_driver_probe() registered with
> the TCM_LOOP bus to create and register the scsi_host.
> However, if the scsi_host memory allocation fails or scsi_add_host()
> fails, the device_register() process still returns success.
> Subsequently, when the user binds the LUN to a specific backend device,
> it accesses the NULL or freed scsi_host.
> 
> Crash Call Trace:
>   RIP: 0010:scsi_is_host_device+0x7/0x20
>   scsi_alloc_target+0x32/0x2c0
>   __scsi_add_device+0x41/0xf0
>   scsi_add_device+0xd/0x30
>   tcm_loop_port_link+0x25/0x50 [tcm_loop]
>   target_fabric_port_link+0x9c/0xb0 [target_core_mod]
>   ...
> 
> This issue is fixed by:
>   1. Setting the tcm_loop_hba's scsi_host to NULL, if
>      scsi_add_host() fails.
>   2. Checking the tcm_loop_hba's scsi_host after device_register().
>   3. Checking the tcm_loop_hba's scsi_host in tcm_loop_driver_remove().
> 
> Fixes: 3703b2c5d041 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>


Reviewed-by: Mike Christie <michael.christie@oracle.com>