Commit 7dae459f authored by Wenchao Hao's avatar Wenchao Hao Committed by Martin K. Petersen
Browse files

scsi: libiscsi: Add iscsi_cls_conn to sysfs after initialization 

iscsi_create_conn() exposed iscsi_cls_conn to sysfs prior to initialization
of iscsi_conn's dd_data. When userspace tried to access an attribute such
as the connect address, a NULL pointer dereference was observed.

Do not add iscsi_cls_conn to sysfs until it has been initialized.  Remove
iscsi_create_conn() since it is no longer used.

Link: https://lore.kernel.org/r/20220310015759.3296841-3-haowenchao@huawei.com


Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Signed-off-by: default avatarWenchao Hao <haowenchao@huawei.com>
Signed-off-by: default avatarWu Bo <wubo40@huawei.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent ad515cad

drivers/scsi/libiscsi.c

+11 −2
Original line number Diff line number Diff line
@@ -3038,8 +3038,9 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size, 
	struct iscsi_conn *conn;

	struct iscsi_cls_conn *cls_conn;

	char *data;

	int err;



	cls_conn = iscsi_create_conn(cls_session, sizeof(*conn) + dd_size,

	cls_conn = iscsi_alloc_conn(cls_session, sizeof(*conn) + dd_size,

				     conn_idx);

	if (!cls_conn)

		return NULL;
@@ -3076,13 +3077,21 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size, 
		goto login_task_data_alloc_fail;

	conn->login_task->data = conn->data = data;



	err = iscsi_add_conn(cls_conn);

	if (err)

		goto login_task_add_dev_fail;



	return cls_conn;



login_task_add_dev_fail:

	free_pages((unsigned long) conn->data,

		   get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));



login_task_data_alloc_fail:

	kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,

		    sizeof(void*));

login_task_alloc_fail:

	iscsi_destroy_conn(cls_conn);

	iscsi_put_conn(cls_conn);

	return NULL;

}

EXPORT_SYMBOL_GPL(iscsi_conn_setup);

drivers/scsi/scsi_transport_iscsi.c

+0 −76
Original line number Diff line number Diff line
@@ -2414,82 +2414,6 @@ void iscsi_remove_conn(struct iscsi_cls_conn *conn) 
}

EXPORT_SYMBOL_GPL(iscsi_remove_conn);



/**

 * iscsi_create_conn - create iscsi class connection

 * @session: iscsi cls session

 * @dd_size: private driver data size

 * @cid: connection id

 *

 * This can be called from a LLD or iscsi_transport. The connection

 * is child of the session so cid must be unique for all connections

 * on the session.

 *

 * Since we do not support MCS, cid will normally be zero. In some cases

 * for software iscsi we could be trying to preallocate a connection struct

 * in which case there could be two connection structs and cid would be

 * non-zero.

 */

struct iscsi_cls_conn *

iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)

{

	struct iscsi_transport *transport = session->transport;

	struct iscsi_cls_conn *conn;

	unsigned long flags;

	int err;



	conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL);

	if (!conn)

		return NULL;

	if (dd_size)

		conn->dd_data = &conn[1];



	mutex_init(&conn->ep_mutex);

	INIT_LIST_HEAD(&conn->conn_list);

	INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn);

	conn->transport = transport;

	conn->cid = cid;

	conn->state = ISCSI_CONN_DOWN;



	/* this is released in the dev's release function */

	if (!get_device(&session->dev))

		goto free_conn;



	dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid);

	conn->dev.parent = &session->dev;

	conn->dev.release = iscsi_conn_release;

	err = device_register(&conn->dev);

	if (err) {

		iscsi_cls_session_printk(KERN_ERR, session, "could not "

					 "register connection's dev\n");

		goto release_parent_ref;

	}

	err = transport_register_device(&conn->dev);

	if (err) {

		iscsi_cls_session_printk(KERN_ERR, session, "could not "

					 "register transport's dev\n");

		goto release_conn_ref;

	}



	spin_lock_irqsave(&connlock, flags);

	list_add(&conn->conn_list, &connlist);

	spin_unlock_irqrestore(&connlock, flags);



	ISCSI_DBG_TRANS_CONN(conn, "Completed conn creation\n");

	return conn;



release_conn_ref:

	device_unregister(&conn->dev);

	put_device(&session->dev);

	return NULL;

release_parent_ref:

	put_device(&session->dev);

free_conn:

	kfree(conn);

	return NULL;

}



EXPORT_SYMBOL_GPL(iscsi_create_conn);



/**

 * iscsi_destroy_conn - destroy iscsi class connection

 * @conn: iscsi cls session

include/scsi/scsi_transport_iscsi.h

+0 −2
Original line number Diff line number Diff line
@@ -446,8 +446,6 @@ extern struct iscsi_cls_conn *iscsi_alloc_conn(struct iscsi_cls_session *sess, 
						int dd_size, uint32_t cid);

extern int iscsi_add_conn(struct iscsi_cls_conn *conn);

extern void iscsi_remove_conn(struct iscsi_cls_conn *conn);

extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,

						int dd_size, uint32_t cid);

extern void iscsi_put_conn(struct iscsi_cls_conn *conn);

extern void iscsi_get_conn(struct iscsi_cls_conn *conn);

extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);