Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db60df88 authored by Nicholas Bellinger's avatar Nicholas Bellinger
Browse files

target: Fail on non zero scsi_status in compare_and_write_callback 



This patch addresses a bug for backends such as IBLOCK that perform
asynchronous completion via transport_complete_cmd(), that will call
target_complete_failure_work() -> transport_generic_request_failure(),
upon exception status and invoke cmd->transport_complete_callback()
-> compare_and_write_callback() incorrectly during the failure case.

It adds a check for a non zero se_cmd->scsi_status within the first
invocation of compare_and_write_callback(), and will jump to out plus
up se_device->caw_sem before exiting the callback.

Reported-by: default avatarThomas Glanzmann <thomas@glanzmann.de>
Tested-by: default avatarThomas Glanzmann <thomas@glanzmann.de>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent d8855c15

drivers/target/target_core_sbc.c

+10 −1
Original line number Diff line number Diff line
@@ -372,7 +372,7 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd) 
{

	struct se_device *dev = cmd->se_dev;

	struct scatterlist *write_sg = NULL, *sg;

	unsigned char *buf, *addr;

	unsigned char *buf = NULL, *addr;

	struct sg_mapping_iter m;

	unsigned int offset = 0, len;

	unsigned int nlbas = cmd->t_task_nolb;
@@ -387,6 +387,15 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd) 
	 */

	if (!cmd->t_data_sg || !cmd->t_bidi_data_sg)

		return TCM_NO_SENSE;

	/*

	 * Immediately exit + release dev->caw_sem if command has already

	 * been failed with a non-zero SCSI status.

	 */

	if (cmd->scsi_status) {

		pr_err("compare_and_write_callback: non zero scsi_status:"

			" 0x%02x\n", cmd->scsi_status);

		goto out;

	}



	buf = kzalloc(cmd->data_length, GFP_KERNEL);

	if (!buf) {