Re: [PATCH 07/21] target: Fix a use-after-free in core_tpg_del_initiator_node_acl()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 01/08/2016 08:43 AM, Nicholas A. Bellinger wrote:
Why do we need to add a second one for something special about
ib_srpt..?

Hello Nic,

I think the reason why so far this issue has only been seen with the SRP protocol is because the SRP target driver is the only one for which an initiator driver exists that supports scsi-mq. I think the scenario which allows me to trigger easily the bug reported at the start of this e-mail is as follows: * Stop LIO. This causes the ib_srpt driver to send a DREQ for each session of each port to the initiator. * If the SRP initiator receives a DREQ for one session it will send a DREQ for all other sessions associated with the same (initiator, target) port pair. * My guess is that when stopping the target stack, if the initiator driver sends these DREQs before the target driver has had the chance to deregister all sessions that this bug gets triggered.

Bart.

--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux SCSI]     [Kernel Newbies]     [Linux SCSI Target Infrastructure]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Device Mapper]

  Powered by Linux