1. 11 Apr, 2014 3 commits
    • Andy Grover's avatar
      target/tcm_fc: Don't export ft_lport_list · b295e769
      Andy Grover authored
      
      
      Nobody outside tfc_conf.c uses it.
      Signed-off-by: Andy Grover's avatarAndy Grover <agrover@redhat.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      b295e769
    • Andy Grover's avatar
      target/tcm_fc: Fix use-after-free of ft_tpg · 2c42be2d
      Andy Grover authored
      ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
      tport when the tpg is being removed. Set this pointer in ft_tport_create,
      or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
      a deleted object.
      
      This patch sets tpg->tport in ft_tport_create, because that's what
      ft_del_tpg checks, and is the only way to get back to the tport to
      clear tport->tpg.
      
      The bug was occuring when:
      
      - lport created, tport (our per-lport, per-provider context) is
        allocated.
        tport->tpg = NULL
      - tpg created
      - a PRLI is received. ft_tport_create is called, tpg is found and
        tport->tpg is set
      - tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
        set, tport->tpg is not cleared and points at freed memory
      - Future calls to ft_tport_create return tport via first conditional,
        instead of searching for new tpg by calling ft_lport_find_tpg.
        tport->tpg is still invalid, and will access freed memory.
      
      see https://bugzilla.redhat.com/show_bug.cgi?id=1071340
      
      
      
      Cc: stable@vger.kernel.org # 3.0+
      Signed-off-by: Andy Grover's avatarAndy Grover <agrover@redhat.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      2c42be2d
    • Alex Leung's avatar
      target: Add check to prevent Abort Task from aborting itself · 47b1584c
      Alex Leung authored
      
      
      This patch addresses an issue that occurs when an ABTS is received
      for an se_cmd that completes just before the sess_cmd_list is searched
      in core_tmr_abort_task(). When the sess_cmd_list is searched, since
      the ABTS and the FCP_CMND being aborted (that just completed) both
      have the same OXID, TFO->get_task_tag(TMR) returns a value that
      matches tmr->ref_task_tag (from TFO->get_task_tag(FCP_CMND)), and
      the Abort Task tries to abort itself. When this occurs,
      transport_wait_for_tasks() hangs forever since the TMR is waiting
      for itself to finish.
      
      This patch adds a check to core_tmr_abort_task() to make sure the
      TMR does not attempt to abort itself.
      Signed-off-by: default avatarAlex Leung <alex.leung@emulex.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      47b1584c
  2. 07 Apr, 2014 32 commits
  3. 13 Mar, 2014 4 commits
  4. 10 Mar, 2014 1 commit