Patch "scsi: target: iscsi: Prevent login threads from racing between each other" has been added to the 5.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    scsi: target: iscsi: Prevent login threads from racing between each other

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     scsi-target-iscsi-prevent-login-threads-from-racing-.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3acee911146c0f644806c0f04cdb28b1827e3f65
Author: Maurizio Lombardi <mlombard@xxxxxxxxxx>
Date:   Mon May 8 18:22:19 2023 +0200

    scsi: target: iscsi: Prevent login threads from racing between each other
    
    [ Upstream commit 2a737d3b8c792400118d6cf94958f559de9c5e59 ]
    
    The tpg->np_login_sem is a semaphore that is used to serialize the login
    process when multiple login threads run concurrently against the same
    target portal group.
    
    The iscsi_target_locate_portal() function finds the tpg, calls
    iscsit_access_np() against the np_login_sem semaphore and saves the tpg
    pointer in conn->tpg;
    
    If iscsi_target_locate_portal() fails, the caller will check for the
    conn->tpg pointer and, if it's not NULL, then it will assume that
    iscsi_target_locate_portal() called iscsit_access_np() on the semaphore.
    
    Make sure that conn->tpg gets initialized only if iscsit_access_np() was
    successful, otherwise iscsit_deaccess_np() may end up being called against
    a semaphore we never took, allowing more than one thread to access the same
    tpg.
    
    Signed-off-by: Maurizio Lombardi <mlombard@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230508162219.1731964-4-mlombard@xxxxxxxxxx
    Reviewed-by: Mike Christie <michael.christie@xxxxxxxxxx>
    Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 8b40f10976ff8..3931565018880 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -1079,6 +1079,7 @@ int iscsi_target_locate_portal(
 	iscsi_target_set_sock_callbacks(conn);
 
 	login->np = np;
+	conn->tpg = NULL;
 
 	login_req = (struct iscsi_login_req *) login->req;
 	payload_length = ntoh24(login_req->dlength);
@@ -1148,7 +1149,6 @@ int iscsi_target_locate_portal(
 	 */
 	sessiontype = strncmp(s_buf, DISCOVERY, 9);
 	if (!sessiontype) {
-		conn->tpg = iscsit_global->discovery_tpg;
 		if (!login->leading_connection)
 			goto get_target;
 
@@ -1165,9 +1165,11 @@ int iscsi_target_locate_portal(
 		 * Serialize access across the discovery struct iscsi_portal_group to
 		 * process login attempt.
 		 */
+		conn->tpg = iscsit_global->discovery_tpg;
 		if (iscsit_access_np(np, conn->tpg) < 0) {
 			iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
 				ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE);
+			conn->tpg = NULL;
 			ret = -1;
 			goto out;
 		}



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux