3.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <n...@linux-iscsi.org>
commit 0ff8754981261a80f4b77db2536dfea92c2d4539 upstream.
This patch adds [dev,lun]_link_magic value assignment + checks within generic
target_fabric_port_link() and target_fabric_mappedlun_link() code to ensure
destination config_item *target_item sent from configfs_symlink() ->
config_item_operations->allow_link() is the underlying se_device->dev_group
and se_lun->lun_group that we expect to symlink.
Reported-by: Sebastian Andrzej Siewior <bige...@linutronix.de>
Cc: Sebastian Andrzej Siewior <bige...@linutronix.de>
Signed-off-by: Nicholas Bellinger <n...@linux-iscsi.org>
Signed-off-by: CAI Qian <caiq...@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
drivers/target/target_core_device.c | 1 +
drivers/target/target_core_fabric_configfs.c | 12 ++++++++++++
drivers/target/target_core_tpg.c | 1 +
drivers/target/target_core_transport.c | 1 +
include/target/target_core_base.h | 4 ++++
5 files changed, 19 insertions(+)
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1624,6 +1624,7 @@ int core_dev_setup_virtual_lun0(void)
ret = PTR_ERR(dev);
goto out;
}
+ dev->dev_link_magic = SE_DEV_LINK_MAGIC;
se_dev->se_dev_ptr = dev;
g_lun0_dev = dev;
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -71,6 +71,12 @@ static int target_fabric_mappedlun_link(
struct se_portal_group *se_tpg;
struct config_item *nacl_ci, *tpg_ci, *tpg_ci_s, *wwn_ci, *wwn_ci_s;
int ret = 0, lun_access;
+
+ if (lun->lun_link_magic != SE_LUN_LINK_MAGIC) {
+ pr_err("Bad lun->lun_link_magic, not a valid lun_ci pointer:"
+ " %p to struct lun: %p\n", lun_ci, lun);
+ return -EFAULT;
+ }
/*
* Ensure that the source port exists
*/
@@ -745,6 +751,12 @@ static int target_fabric_port_link(
struct target_fabric_configfs *tf;
int ret;
+ if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
+ pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
+ " %p to struct se_device: %p\n", se_dev_ci, dev);
+ return -EFAULT;
+ }
+
tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
se_tpg = container_of(to_config_group(tpg_ci),
struct se_portal_group, tpg_group);
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -672,6 +672,7 @@ int core_tpg_register(
for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
lun = se_tpg->tpg_lun_list[i];
lun->unpacked_lun = i;
+ lun->lun_link_magic = SE_LUN_LINK_MAGIC;
lun->lun_status = TRANSPORT_LUN_STATUS_FREE;
atomic_set(&lun->lun_acl_count, 0);
init_completion(&lun->lun_shutdown_comp);
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1071,6 +1071,7 @@ struct se_device *transport_add_device_t
dev->se_hba = hba;
dev->se_sub_dev = se_dev;
dev->transport = transport;
+ dev->dev_link_magic = SE_DEV_LINK_MAGIC;
INIT_LIST_HEAD(&dev->dev_list);
INIT_LIST_HEAD(&dev->dev_sep_list);
INIT_LIST_HEAD(&dev->dev_tmr_list);
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -734,6 +734,8 @@ struct se_subsystem_dev {
};
struct se_device {
+#define SE_DEV_LINK_MAGIC 0xfeeddeef
+ u32 dev_link_magic;
/* RELATIVE TARGET PORT IDENTIFER Counter */
u16 dev_rpti_counter;
/* Used for SAM Task Attribute ordering */
@@ -820,6 +822,8 @@ struct se_port_stat_grps {
};
struct se_lun {
+#define SE_LUN_LINK_MAGIC 0xffff7771
+ u32 lun_link_magic;
/* See transport_lun_status_table */
enum transport_lun_status_table lun_status;
u32 lun_access;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
