Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 679fcae4 authored by Laura Abbott's avatar Laura Abbott Committed by Martin K. Petersen
Browse files

scsi: iscsi: target: Don't use stack buffer for scatterlist 



Fedora got a bug report of a crash with iSCSI:

kernel BUG at include/linux/scatterlist.h:143!
...
RIP: 0010:iscsit_do_crypto_hash_buf+0x154/0x180 [iscsi_target_mod]
...
 Call Trace:
  ? iscsi_target_tx_thread+0x200/0x200 [iscsi_target_mod]
  iscsit_get_rx_pdu+0x4cd/0xa90 [iscsi_target_mod]
  ? native_sched_clock+0x3e/0xa0
  ? iscsi_target_tx_thread+0x200/0x200 [iscsi_target_mod]
  iscsi_target_rx_thread+0x81/0xf0 [iscsi_target_mod]
  kthread+0x120/0x140
  ? kthread_create_worker_on_cpu+0x70/0x70
  ret_from_fork+0x3a/0x50

This is a BUG_ON for using a stack buffer with a scatterlist.  There
are two cases that trigger this bug. Switch to using a dynamically
allocated buffer for one case and do not assign a NULL buffer in
another case.

Signed-off-by: default avatarLaura Abbott <labbott@redhat.com>
Reviewed-by: default avatarMike Christie <mchristi@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent c77a2fa3

drivers/target/iscsi/iscsi_target.c

+14 −8
Original line number Diff line number Diff line
@@ -1416,6 +1416,7 @@ static void iscsit_do_crypto_hash_buf(struct ahash_request *hash, 


	sg_init_table(sg, ARRAY_SIZE(sg));

	sg_set_buf(sg, buf, payload_length);

	if (padding)

		sg_set_buf(sg + 1, pad_bytes, padding);



	ahash_request_set_crypt(hash, sg, data_crc, payload_length + padding);
@@ -3910,10 +3911,14 @@ static bool iscsi_target_check_conn_state(struct iscsi_conn *conn) 
static void iscsit_get_rx_pdu(struct iscsi_conn *conn)

{

	int ret;

	u8 buffer[ISCSI_HDR_LEN], opcode;

	u8 *buffer, opcode;

	u32 checksum = 0, digest = 0;

	struct kvec iov;



	buffer = kcalloc(ISCSI_HDR_LEN, sizeof(*buffer), GFP_KERNEL);

	if (!buffer)

		return;



	while (!kthread_should_stop()) {

		/*

		 * Ensure that both TX and RX per connection kthreads
@@ -3921,7 +3926,6 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) 
		 */

		iscsit_thread_check_cpumask(conn, current, 0);



		memset(buffer, 0, ISCSI_HDR_LEN);

		memset(&iov, 0, sizeof(struct kvec));



		iov.iov_base	= buffer;
@@ -3930,7 +3934,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) 
		ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN);

		if (ret != ISCSI_HDR_LEN) {

			iscsit_rx_thread_wait_for_tcp(conn);

			return;

			break;

		}



		if (conn->conn_ops->HeaderDigest) {
@@ -3940,7 +3944,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) 
			ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);

			if (ret != ISCSI_CRC_LEN) {

				iscsit_rx_thread_wait_for_tcp(conn);

				return;

				break;

			}



			iscsit_do_crypto_hash_buf(conn->conn_rx_hash, buffer,
@@ -3964,7 +3968,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) 
		}



		if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)

			return;

			break;



		opcode = buffer[0] & ISCSI_OPCODE_MASK;
@@ -3975,13 +3979,15 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) 
			" while in Discovery Session, rejecting.\n", opcode);

			iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,

					  buffer);

			return;

			break;

		}



		ret = iscsi_target_rx_opcode(conn, buffer);

		if (ret < 0)

			return;

			break;

	}



	kfree(buffer);

}



int iscsi_target_rx_thread(void *arg)