From patchwork Tue Oct 31 18:03:18 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10035081 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3084E60327 for ; Tue, 31 Oct 2017 18:03:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 287342884E for ; Tue, 31 Oct 2017 18:03:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 175DF28A5F; Tue, 31 Oct 2017 18:03:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B23592884E for ; Tue, 31 Oct 2017 18:03:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932632AbdJaSDd (ORCPT ); Tue, 31 Oct 2017 14:03:33 -0400 Received: from esa4.hgst.iphmx.com ([216.71.154.42]:49581 "EHLO esa4.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932637AbdJaSD2 (ORCPT ); Tue, 31 Oct 2017 14:03:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wdc.com; i=@wdc.com; q=dns/txt; s=dkim.wdc.com; t=1509473009; x=1541009009; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=dyLO9V4x4k8Lyd+/gLjk/iSp94wp7jE6JjZ/o44wPQg=; b=XBaRNe6Qmk7W5tKgKK8zHF/d7T3sDsrXdiDoTzV3DfakdTkxhaFP3zld 0/SWE+RfTiSFSbyYKdEZvMfkXaeDq6v0p/qYLYIzfMw2Ko3VxFo+9XzD7 PTPHm0T/aNSsYq/Ao4b3isbxLFg7AQoprWpgoSHqkI+6p4qRyvPH9qK7N W+8MTlqN3T8tEdQtfGnIPaAcFfz2ogVHhJOv1r9v7Y5JaL+88aEO/e5Ed IBwQCzGY6hwAFOBfx1v4WIU9BcCvE6dKB/DBBGXCVIn5ObNntEdwGx8Ch PN2ZYC1Tem1wZCZ2ZdTlAPYeHnkP7rUvlBIjh5bTeMXKYvTZqSkpa/Iy9 A==; X-IronPort-AV: E=Sophos;i="5.44,325,1505750400"; d="scan'208";a="60328650" Received: from h199-255-45-15.hgst.com (HELO uls-op-cesaep02.wdc.com) ([199.255.45.15]) by ob1.hgst.iphmx.com with ESMTP; 01 Nov 2017 02:03:24 +0800 Received: from uls-op-cesaip02.wdc.com ([10.248.3.37]) by uls-op-cesaep02.wdc.com with ESMTP; 31 Oct 2017 11:01:09 -0700 Received: from unknown (HELO MILHUBIP03.sdcorp.global.sandisk.com) ([10.177.9.96]) by uls-op-cesaip02.wdc.com with ESMTP; 31 Oct 2017 11:03:25 -0700 Received: from milsmgip12.sandisk.com (10.177.8.100) by MILHUBIP03.sdcorp.global.sandisk.com (10.177.9.96) with Microsoft SMTP Server id 14.3.319.2; Tue, 31 Oct 2017 11:03:23 -0700 X-AuditID: 0ab1095a-d99e3980000146e4-55-59f8baea77b2 Received: from thinkpad-bart.int.fusionio.com ( [10.177.8.100]) by (Symantec Messaging Gateway) with SMTP id 3D.A9.18148.AEAB8F95; Tue, 31 Oct 2017 11:03:23 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" , "James E . J . Bottomley" CC: Nicholas Bellinger , Christoph Hellwig , , Bart Van Assche , Hannes Reinecke , Mike Christie Subject: [PATCH 10/11] target/iscsi: Detect conn_cmd_list corruption early Date: Tue, 31 Oct 2017 11:03:18 -0700 Message-ID: <20171031180319.19258-11-bart.vanassche@wdc.com> X-Mailer: git-send-email 2.14.2 In-Reply-To: <20171031180319.19258-1-bart.vanassche@wdc.com> References: <20171031180319.19258-1-bart.vanassche@wdc.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrEJMWRmVeSWpSXmKPExsXCtZEjRff1rh+RBtPSLC79+cJoseDNXjaL lauPMlmsmphnsfz4PyaL9Uc2MFq0rT7DaNG69C2TA4fH/e1HmDweHNrM4rH7ZgObx8ent1g8 3u+7yuaxfstVFo/Pm+Q82g90MwVwRHHZpKTmZJalFunbJXBl/Ji0kq1gE2/Fvv3T2RsYl3N3 MXJySAiYSPQtfszYxcjFISSwmlHixpR9jCAJNgE9iVPz9jGB2CICuRKnHt5gAiliFnjCKNHy cx87SEJYwEvi2c8VzF2MHBwsAqoST7siQcK8AjYSF5tPs0AskJd4v+A+2ExOoPjbnt1gcSEB a4lre5cwT2DkXsDIsIpRLDczpzg3PbPA0EivODEvJbM4Wy85P3cTIziUOKN2MF6faH6IkYmD U6qBcaftT0m1pAlFtn8inl0wumR7bRmr08zyW1a7DO9+fHq4tymV54DVnlkL9n1YX6RyIP5w PpfQSpGbf+erbtK7VsIQtFhGdddXn8uHTKK0N17Xm739buT+nxV606Vtmz8WTqtnWhM9fcov 4bauuR83vFtdLGi9ZpJ+xPIve3PE2tafdnKb75qatkyJpTgj0VCLuag4EQAeU0Cm1QEAAA== MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Certain behavior of the initiator can cause the target driver to send both a reject and a SCSI response. If that happens two target_put_sess_cmd() calls will occur without the command having been removed from conn_cmd_list. In other words, conn_cmd_list will get corrupted once the freed memory is reused. Although the Linux kernel can detect list corruption if list debugging is enabled, in this case the context in which list corruption is detected is not related to the context that caused list corruption. Hence add WARN_ON() statements that report the context that is causing list corruption. Signed-off-by: Bart Van Assche Cc: Nicholas Bellinger Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Mike Christie Reviewed-by: Hannes Reinecke --- drivers/target/iscsi/iscsi_target_util.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c index 1e36f83b5961..70c6b9bfc04e 100644 --- a/drivers/target/iscsi/iscsi_target_util.c +++ b/drivers/target/iscsi/iscsi_target_util.c @@ -694,6 +694,8 @@ void iscsit_release_cmd(struct iscsi_cmd *cmd) struct iscsi_session *sess; struct se_cmd *se_cmd = &cmd->se_cmd; + WARN_ON(!list_empty(&cmd->i_conn_node)); + if (cmd->conn) sess = cmd->conn->sess; else @@ -716,6 +718,8 @@ void __iscsit_free_cmd(struct iscsi_cmd *cmd, bool check_queues) { struct iscsi_conn *conn = cmd->conn; + WARN_ON(!list_empty(&cmd->i_conn_node)); + if (cmd->data_direction == DMA_TO_DEVICE) { iscsit_stop_dataout_timer(cmd); iscsit_free_r2ts_from_list(cmd);