Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7f7fd5b authored by Mike Christie's avatar Mike Christie Committed by James Bottomley
Browse files

[SCSI] be2iscsi: fix null ptr ref in conn get param 



The ep_disconnect function could be freeing the ep
while beiscsi_conn_get_param is running. This has
the driver use the get ep param callback instead
of the get conn param to fix this.

Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent 7c53c6f8

drivers/scsi/be2iscsi/be_iscsi.c

+5 −13
Original line number Diff line number Diff line
@@ -210,28 +210,20 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_session, 
}



/**

 * beiscsi_conn_get_param - get the iscsi parameter

 * @cls_conn: pointer to iscsi cls conn

 * beiscsi_ep_get_param - get the iscsi parameter

 * @ep: pointer to iscsi ep

 * @param: parameter type identifier

 * @buf: buffer pointer

 *

 * returns iscsi parameter

 */

int beiscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,

int beiscsi_ep_get_param(struct iscsi_endpoint *ep,

			   enum iscsi_param param, char *buf)

{

	struct beiscsi_endpoint *beiscsi_ep;

	struct iscsi_conn *conn = cls_conn->dd_data;

	struct beiscsi_conn *beiscsi_conn = conn->dd_data;

	struct beiscsi_endpoint *beiscsi_ep = ep->dd_data;

	int len = 0;



	SE_DEBUG(DBG_LVL_8, "In beiscsi_conn_get_param, param= %d\n", param);

	beiscsi_ep = beiscsi_conn->ep;

	if (!beiscsi_ep) {

		SE_DEBUG(DBG_LVL_1,

			 "In beiscsi_conn_get_param , no beiscsi_ep\n");

		return -ENODEV;

	}



	switch (param) {

	case ISCSI_PARAM_CONN_PORT:
@@ -244,7 +236,7 @@ int beiscsi_conn_get_param(struct iscsi_cls_conn *cls_conn, 
			len = sprintf(buf, "%pI6\n", &beiscsi_ep->dst6_addr);

		break;

	default:

		return iscsi_conn_get_param(cls_conn, param, buf);

		return -ENOSYS;

	}

	return len;

}

drivers/scsi/be2iscsi/be_iscsi.h

+2 −2
Original line number Diff line number Diff line
@@ -48,8 +48,8 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_session, 
		      struct iscsi_cls_conn *cls_conn,

		      uint64_t transport_fd, int is_leading);



int beiscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,

			   enum iscsi_param param, char *buf);

int beiscsi_ep_get_param(struct iscsi_endpoint *ep, enum iscsi_param param,

			 char *buf);



int beiscsi_get_host_param(struct Scsi_Host *shost,

			   enum iscsi_host_param param, char *buf);

drivers/scsi/be2iscsi/be_main.c

+2 −1
Original line number Diff line number Diff line
@@ -4384,7 +4384,7 @@ struct iscsi_transport beiscsi_iscsi_transport = { 
	.bind_conn = beiscsi_conn_bind,

	.destroy_conn = iscsi_conn_teardown,

	.set_param = beiscsi_set_param,

	.get_conn_param = beiscsi_conn_get_param,

	.get_conn_param = iscsi_conn_get_param,

	.get_session_param = iscsi_session_get_param,

	.get_host_param = beiscsi_get_host_param,

	.start_conn = beiscsi_conn_start,
@@ -4395,6 +4395,7 @@ struct iscsi_transport beiscsi_iscsi_transport = { 
	.alloc_pdu = beiscsi_alloc_pdu,

	.parse_pdu_itt = beiscsi_parse_pdu,

	.get_stats = beiscsi_conn_get_stats,

	.get_ep_param = beiscsi_ep_get_param,

	.ep_connect = beiscsi_ep_connect,

	.ep_poll = beiscsi_ep_poll,

	.ep_disconnect = beiscsi_ep_disconnect,