diff mbox

[3.16.y-ckt,stable] Patch "iscsi-target: Avoid early conn_logout_comp for iser connections" has been added to staging queue

Message ID 1427720489-13156-1-git-send-email-luis.henriques@canonical.com
State New
Headers show

Commit Message

Luis Henriques March 30, 2015, 1:01 p.m. UTC
This is a note to let you know that I have just added a patch titled

    iscsi-target: Avoid early conn_logout_comp for iser connections

to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue

This patch is scheduled to be released in version 3.16.7-ckt10.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

From 41e5c1d8cb477f89f8fa3fb21406a47386e3a58e Mon Sep 17 00:00:00 2001
From: Nicholas Bellinger <nab@linux-iscsi.org>
Date: Mon, 23 Feb 2015 00:57:51 -0800
Subject: iscsi-target: Avoid early conn_logout_comp for iser connections

commit f068fbc82e7696d67b1bb8189306865bedf368b6 upstream.

This patch fixes a iser specific logout bug where early complete()
of conn->conn_logout_comp in iscsit_close_connection() was causing
isert_wait4logout() to complete too soon, triggering a use after
free NULL pointer dereference of iscsi_conn memory.

The complete() was originally added for traditional iscsi-target
when a ISCSI_LOGOUT_OP failed in iscsi_target_rx_opcode(), but given
iser-target does not wait in logout failure, this special case needs
to be avoided.

Reported-by: Sagi Grimberg <sagig@mellanox.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Slava Shwartsman <valyushash@gmail.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/target/iscsi/iscsi_target.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

Comments

Sagi Grimberg March 30, 2015, 1:04 p.m. UTC | #1
On 3/30/2015 4:01 PM, Luis Henriques wrote:
> This is a note to let you know that I have just added a patch titled
>
>      iscsi-target: Avoid early conn_logout_comp for iser connections
>
> to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree
> which can be found at:
>
>   http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue
>
> This patch is scheduled to be released in version 3.16.7-ckt10.
>
> If you, or anyone else, feels it should not be added to this tree, please
> reply to this email.

Umm, I think this patch was already objected. Please remove it from
stable.
Luis Henriques March 30, 2015, 1:32 p.m. UTC | #2
On Mon, Mar 30, 2015 at 04:04:51PM +0300, Sagi Grimberg wrote:
> On 3/30/2015 4:01 PM, Luis Henriques wrote:
> >This is a note to let you know that I have just added a patch titled
> >
> >     iscsi-target: Avoid early conn_logout_comp for iser connections
> >
> >to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree
> >which can be found at:
> >
> >  http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue
> >
> >This patch is scheduled to be released in version 3.16.7-ckt10.
> >
> >If you, or anyone else, feels it should not be added to this tree, please
> >reply to this email.
> 
> Umm, I think this patch was already objected. Please remove it from
> stable.

Thank you for your feedback, Sagi.  Unfortunately, I couldn't find any
reference to an objection of this patch being included in stable
trees.  In fact, it looks like it has already been included in at
least 3 stable releases: 3.19.3, 3.14.37 and 3.10.73.

Could you please provide some more details or references?

Cheers,
--
Luís
Sagi Grimberg March 30, 2015, 1:39 p.m. UTC | #3
On 3/30/2015 4:32 PM, Luis Henriques wrote:
> On Mon, Mar 30, 2015 at 04:04:51PM +0300, Sagi Grimberg wrote:
>> On 3/30/2015 4:01 PM, Luis Henriques wrote:
>>> This is a note to let you know that I have just added a patch titled
>>>
>>>      iscsi-target: Avoid early conn_logout_comp for iser connections
>>>
>>> to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree
>>> which can be found at:
>>>
>>>   http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue
>>>
>>> This patch is scheduled to be released in version 3.16.7-ckt10.
>>>
>>> If you, or anyone else, feels it should not be added to this tree, please
>>> reply to this email.
>>
>> Umm, I think this patch was already objected. Please remove it from
>> stable.
>
> Thank you for your feedback, Sagi.  Unfortunately, I couldn't find any
> reference to an objection of this patch being included in stable
> trees.  In fact, it looks like it has already been included in at
> least 3 stable releases: 3.19.3, 3.14.37 and 3.10.73.
>
> Could you please provide some more details or references?

Ohhh, got confused with:
iscsi-target: Avoid IN_LOGOUT failure case for iser-target" has been 
added to staging queue

Sorry,

Please ignore this comment.

Sagi.
Luis Henriques March 30, 2015, 1:45 p.m. UTC | #4
On Mon, Mar 30, 2015 at 04:39:13PM +0300, Sagi Grimberg wrote:
> On 3/30/2015 4:32 PM, Luis Henriques wrote:
> >On Mon, Mar 30, 2015 at 04:04:51PM +0300, Sagi Grimberg wrote:
> >>On 3/30/2015 4:01 PM, Luis Henriques wrote:
> >>>This is a note to let you know that I have just added a patch titled
> >>>
> >>>     iscsi-target: Avoid early conn_logout_comp for iser connections
> >>>
> >>>to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree
> >>>which can be found at:
> >>>
> >>>  http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue
> >>>
> >>>This patch is scheduled to be released in version 3.16.7-ckt10.
> >>>
> >>>If you, or anyone else, feels it should not be added to this tree, please
> >>>reply to this email.
> >>
> >>Umm, I think this patch was already objected. Please remove it from
> >>stable.
> >
> >Thank you for your feedback, Sagi.  Unfortunately, I couldn't find any
> >reference to an objection of this patch being included in stable
> >trees.  In fact, it looks like it has already been included in at
> >least 3 stable releases: 3.19.3, 3.14.37 and 3.10.73.
> >
> >Could you please provide some more details or references?
> 
> Ohhh, got confused with:
> iscsi-target: Avoid IN_LOGOUT failure case for iser-target" has been added
> to staging queue
>

Ah, yeah.  That's the one that was reverted upstream.

> Sorry,
> 
> Please ignore this comment.
> 
> Sagi.

No problem.  Thanks!

Cheers,
--
Luís
diff mbox

Patch

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 260c3e1e312c..209eb58b5d3a 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4223,11 +4223,17 @@  int iscsit_close_connection(
 	pr_debug("Closing iSCSI connection CID %hu on SID:"
 		" %u\n", conn->cid, sess->sid);
 	/*
-	 * Always up conn_logout_comp just in case the RX Thread is sleeping
-	 * and the logout response never got sent because the connection
-	 * failed.
+	 * Always up conn_logout_comp for the traditional TCP case just in case
+	 * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
+	 * response never got sent because the connection failed.
+	 *
+	 * However for iser-target, isert_wait4logout() is using conn_logout_comp
+	 * to signal logout response TX interrupt completion.  Go ahead and skip
+	 * this for iser since isert_rx_opcode() does not wait on logout failure,
+	 * and to avoid iscsi_conn pointer dereference in iser-target code.
 	 */
-	complete(&conn->conn_logout_comp);
+	if (conn->conn_transport->transport_type == ISCSI_TCP)
+		complete(&conn->conn_logout_comp);

 	iscsi_release_thread_set(conn);