Commit 92d47000 authored by Wang Hai's avatar Wang Hai Committed by Zheng Qixing
Browse files

scsi: target: core: Fix null-ptr-deref in target_alloc_device() 

mainline inclusion
from mainline-v6.12-rc4
commit fca6caeb4a61d240f031914413fcc69534f6dc03
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SU3
CVE: CVE-2024-50153

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fca6caeb4a61d240f031914413fcc69534f6dc03



------------------------

There is a null-ptr-deref issue reported by KASAN:

BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod]
...
 kasan_report+0xb9/0xf0
 target_alloc_device+0xbc4/0xbe0 [target_core_mod]
 core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod]
 target_core_init_configfs+0x205/0x420 [target_core_mod]
 do_one_initcall+0xdd/0x4e0
...
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

In target_alloc_device(), if allocing memory for dev queues fails, then
dev will be freed by dev->transport->free_device(), but dev->transport
is not initialized at that time, which will lead to a null pointer
reference problem.

Fixing this bug by freeing dev with hba->backend->ops->free_device().

Fixes: 1526d9f1 ("scsi: target: Make state_list per CPU")
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20241011113444.40749-1-wanghai38@huawei.com


Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarZheng Qixing <zhengqixing@huawei.com>
parent 4cbb7363

drivers/target/target_core_device.c

+1 −1
Original line number Diff line number Diff line
@@ -727,7 +727,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) 


	dev->queues = kcalloc(nr_cpu_ids, sizeof(*dev->queues), GFP_KERNEL);

	if (!dev->queues) {

		dev->transport->free_device(dev);

		hba->backend->ops->free_device(dev);

		return NULL;

	}