From patchwork Tue Nov 6 17:17:12 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10670875 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6C5B71803 for ; Tue, 6 Nov 2018 17:18:54 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 525722AA27 for ; Tue, 6 Nov 2018 17:18:54 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 46E862AA2E; Tue, 6 Nov 2018 17:18:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 41BE82AA27 for ; Tue, 6 Nov 2018 17:18:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389281AbeKGCpE (ORCPT ); Tue, 6 Nov 2018 21:45:04 -0500 Received: from com-out001.mailprotect.be ([83.217.72.83]:57659 "EHLO com-out001.mailprotect.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389286AbeKGCpE (ORCPT ); Tue, 6 Nov 2018 21:45:04 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mailprotect.be; s=mail; h=Content-Transfer-Encoding:MIME-Version:References :In-Reply-To:Message-Id:Date:Subject:Cc:To:From:reply-to:sender:bcc: content-type; bh=y1zijoD7V1EOZ6JexeXVLLM32qYX1FHnjcFM9Rj7q7U=; b=EIfnSQuhJGJr xuaZbfCzT8zOjpJMd2IhHUc39O1bNmipKCD2tOjKExtkXn+2/TjgL42YLCboJXmwist+Yc8DNXmED d+PmtE0BBo7nhdAHU8UYYeQ3aWfHJ428mLo3en6BfF3r5R+6rNJeONvNOT8nHRynpUQgYBdvFWDEa ITBdd19T02B9ZJGaF0IFqb2wkZJZVAeCATtvSCs2b9kXy82f5+vA5yrQ9NgpYyEsypQ/XCxBCwwen L4ye9LM50D/q/B3b4HVzmPDCErjQ0hrCcako5qGnVHV3TpGZR2fknhuHnMsHDoocAA8RchK1Dx5zv jEj4JEU3KesN40tAw1rUfQ==; Received: from smtp-auth.mailprotect.be ([178.208.39.159]) by com-mpt-out001.mailprotect.be with esmtp (Exim 4.89) (envelope-from ) id 1gK4zr-000CLa-Vz; Tue, 06 Nov 2018 18:18:41 +0100 Received: from desktop-bart.svl.corp.google.com (unknown [104.133.8.89]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp-auth.mailprotect.be (Postfix) with ESMTPSA id 13846C0C8A; Tue, 6 Nov 2018 18:18:31 +0100 (CET) From: Bart Van Assche To: "Martin K . Petersen" Cc: Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Nicholas Bellinger , Mike Christie , David Disseldorp , Hannes Reinecke Subject: [PATCH 04/10] target/core: Make sure that target_wait_for_sess_cmds() waits long enough Date: Tue, 6 Nov 2018 09:17:12 -0800 Message-Id: <20181106171718.89594-5-bvanassche@acm.org> X-Mailer: git-send-email 2.19.1.930.g4563a0d9d0-goog In-Reply-To: <20181106171718.89594-1-bvanassche@acm.org> References: <20181106171718.89594-1-bvanassche@acm.org> MIME-Version: 1.0 X-Originating-IP: 178.208.39.159 X-SpamExperts-Domain: mailprotect.be X-SpamExperts-Username: 178.208.39.128/27 Authentication-Results: mailprotect.be; auth=pass smtp.auth=178.208.39.128/27@mailprotect.be X-SpamExperts-Outgoing-Class: ham X-SpamExperts-Outgoing-Evidence: SB/global_tokens (0.00184631991759) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5oTkgpwpCqOOjiMhDH1K5vp602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO1tLifGj39bI0bcPyaJsYTagCTS5H5Pie2sCQ3gGSzr06cM7U7xDGmYwNG93LVnxwxjk yGQYCd08t3lHobjxX/OigDGQOIiVUN5rGO3B5zfVpnsdsF0/474T9aStD4uEKVG9P9yTThxC66Ku Xb0HO3W8nbMwgkUuW83PKbk25YSnvgtxKKcMIJ7ptgUxRg53TuCt4QJNIvyoxb4710Nl6KAZZ+9r UkyLOOkgJ9eTXvOC4trOptRiSOXsXUvIrRE5Gn9IoDI3FwcKOGmPp98nE8JI2C8QBYsWIMCVBHpa 7Qj+JYN6Crh9DXUDEtWWsjsNUWDlGPaDR+Aes7asAZpVFyfMODodi5MLJiAvrVIiQFNhc8S+HKYI 1vbaqYoREZsvVKq8YZ9/SG1CqFB/T9oOuGliwtRkR+GX5UQPXdpKZF7ITlSXoP8r3OOc9CaULF46 7VT2rSAdw3oKkBNp3q2CTUjaBEkZvVwfNyBf8N9Cj3+++mTSKn34bbFRlO1kXUycpH0i0CUyLQvl 9O+c0636VhIifL76GD10kuo3nOZaoX+g3LKzgLvGn75f1GdWNx/7rKBnyF5Al8KyqkBC47VmroNn IKDFkcg0DoDn7tP2jpvLswQ+LrsRjP8UUIXm0+DPmv7PKPGj8NXeGCulL/QJEqN6EipRzMVZ5Lqw Tx7Vvn9S5OBZ87WmFyXBm/oIAtLmOrCBf5k3qwLPOJPnfDsxRzB+BCXXJcb4hoyR6yACXgxi1tj3 tnRFP71SNe8OabONmAeYUOp7A73HI6oJg7w/Vocy7+Ttx50kPf/opRnU1TyFH6IJwoZKvMkvY/jz 9IkVzN59uTrDo5OUYDGpGZVhMc74agj+RX0dbSrc5Jkf/lehMDRcCgYQIezXimM8MMGBqePpnOc1 Yjsvm51FfilkyeTjx6VdUzwc6VGfl9kqYqrqKK10ONaLwqjc31fO80X8Z+zAFWmAK6L8pLjYAyx9 cPRwc/tu2n0gQeKRgdo8fP/wbsmG5LlZyL0etItIQ47Q9ScHL8+lTGBIVE9xbEkX79tiWrQqR9OH b3+AhBHyQJhMoK6//HisH+Inv79AsPwENh1/rxbQicf/5tMwo2bfwwdcWaJjyTNTJd/rBV6qRhfQ Ewne7W7yM4pg5t5Ye8wOsvdQwaaQ0m5yz9ncfoPJBe4xL7hrJSk60SF3F6RYOYr2 X-Report-Abuse-To: spam@com-mpt-mgt001.mailprotect.be Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP A session must only be released after all code that accesses the session structure has finished. Make sure that this is the case by introducing a new command counter per session that is only decremented after the .release_cmd() callback has finished. This patch fixes the following crash: BUG: KASAN: use-after-free in do_raw_spin_lock+0x1c/0x130 Read of size 4 at addr ffff8801534b16e4 by task rmdir/14805 CPU: 16 PID: 14805 Comm: rmdir Not tainted 4.18.0-rc2-dbg+ #5 Call Trace: dump_stack+0xa4/0xf5 print_address_description+0x6f/0x270 kasan_report+0x241/0x360 __asan_load4+0x78/0x80 do_raw_spin_lock+0x1c/0x130 _raw_spin_lock_irqsave+0x52/0x60 srpt_set_ch_state+0x27/0x70 [ib_srpt] srpt_disconnect_ch+0x1b/0xc0 [ib_srpt] srpt_close_session+0xa8/0x260 [ib_srpt] target_shutdown_sessions+0x170/0x180 [target_core_mod] core_tpg_del_initiator_node_acl+0xf3/0x200 [target_core_mod] target_fabric_nacl_base_release+0x25/0x30 [target_core_mod] config_item_release+0x9c/0x110 [configfs] config_item_put+0x26/0x30 [configfs] configfs_rmdir+0x3b8/0x510 [configfs] vfs_rmdir+0xb3/0x1e0 do_rmdir+0x262/0x2c0 do_syscall_64+0x77/0x230 entry_SYSCALL_64_after_hwframe+0x49/0xbe Cc: Nicholas Bellinger Cc: Mike Christie Cc: Christoph Hellwig Cc: David Disseldorp Cc: Hannes Reinecke Signed-off-by: Bart Van Assche --- drivers/target/target_core_transport.c | 35 ++++++++++++++++++-------- drivers/target/target_core_xcopy.c | 6 ++++- include/target/target_core_base.h | 1 + include/target/target_core_fabric.h | 2 +- 4 files changed, 32 insertions(+), 12 deletions(-) diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index a2cecbec9b8e..3c4335e56f08 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -224,19 +224,28 @@ void transport_subsystem_check_init(void) sub_api_initialized = 1; } +static void target_release_sess_cmd_refcnt(struct percpu_ref *ref) +{ + struct se_session *sess = container_of(ref, typeof(*sess), cmd_count); + + wake_up(&sess->cmd_list_wq); +} + /** * transport_init_session - initialize a session object * @se_sess: Session object pointer. * * The caller must have zero-initialized @se_sess before calling this function. */ -void transport_init_session(struct se_session *se_sess) +int transport_init_session(struct se_session *se_sess) { INIT_LIST_HEAD(&se_sess->sess_list); INIT_LIST_HEAD(&se_sess->sess_acl_list); INIT_LIST_HEAD(&se_sess->sess_cmd_list); spin_lock_init(&se_sess->sess_cmd_lock); init_waitqueue_head(&se_sess->cmd_list_wq); + return percpu_ref_init(&se_sess->cmd_count, + target_release_sess_cmd_refcnt, 0, GFP_KERNEL); } EXPORT_SYMBOL(transport_init_session); @@ -247,6 +256,7 @@ EXPORT_SYMBOL(transport_init_session); struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops) { struct se_session *se_sess; + int ret; se_sess = kmem_cache_zalloc(se_sess_cache, GFP_KERNEL); if (!se_sess) { @@ -254,7 +264,11 @@ struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops) " se_sess_cache\n"); return ERR_PTR(-ENOMEM); } - transport_init_session(se_sess); + ret = transport_init_session(se_sess); + if (ret < 0) { + kfree(se_sess); + return ERR_PTR(ret); + } se_sess->sup_prot_ops = sup_prot_ops; return se_sess; @@ -577,6 +591,7 @@ void transport_free_session(struct se_session *se_sess) sbitmap_queue_free(&se_sess->sess_tag_pool); kvfree(se_sess->sess_cmd_map); } + percpu_ref_exit(&se_sess->cmd_count); kmem_cache_free(se_sess_cache, se_sess); } EXPORT_SYMBOL(transport_free_session); @@ -2715,6 +2730,7 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref) } se_cmd->transport_state |= CMD_T_PRE_EXECUTE; list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list); + percpu_ref_get(&se_sess->cmd_count); out: spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); @@ -2745,8 +2761,6 @@ static void target_release_cmd_kref(struct kref *kref) if (se_sess) { spin_lock_irqsave(&se_sess->sess_cmd_lock, flags); list_del_init(&se_cmd->se_cmd_list); - if (se_sess->sess_tearing_down && list_empty(&se_sess->sess_cmd_list)) - wake_up(&se_sess->cmd_list_wq); spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); } @@ -2754,6 +2768,8 @@ static void target_release_cmd_kref(struct kref *kref) se_cmd->se_tfo->release_cmd(se_cmd); if (compl) complete(compl); + + percpu_ref_put(&se_sess->cmd_count); } /** @@ -2882,6 +2898,8 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess) spin_lock_irqsave(&se_sess->sess_cmd_lock, flags); se_sess->sess_tearing_down = 1; spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); + + percpu_ref_kill(&se_sess->cmd_count); } EXPORT_SYMBOL(target_sess_cmd_list_set_waiting); @@ -2896,17 +2914,14 @@ void target_wait_for_sess_cmds(struct se_session *se_sess) WARN_ON_ONCE(!se_sess->sess_tearing_down); - spin_lock_irq(&se_sess->sess_cmd_lock); do { - ret = wait_event_lock_irq_timeout( - se_sess->cmd_list_wq, - list_empty(&se_sess->sess_cmd_list), - se_sess->sess_cmd_lock, 180 * HZ); + ret = wait_event_timeout(se_sess->cmd_list_wq, + percpu_ref_is_zero(&se_sess->cmd_count), + 180 * HZ); list_for_each_entry(cmd, &se_sess->sess_cmd_list, se_cmd_list) target_show_cmd("session shutdown: still waiting for ", cmd); } while (ret <= 0); - spin_unlock_irq(&se_sess->sess_cmd_lock); } EXPORT_SYMBOL(target_wait_for_sess_cmds); diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c index 70adcfdca8d1..124495f953fa 100644 --- a/drivers/target/target_core_xcopy.c +++ b/drivers/target/target_core_xcopy.c @@ -479,6 +479,8 @@ static const struct target_core_fabric_ops xcopy_pt_tfo = { int target_xcopy_setup_pt(void) { + int ret; + xcopy_wq = alloc_workqueue("xcopy_wq", WQ_MEM_RECLAIM, 0); if (!xcopy_wq) { pr_err("Unable to allocate xcopy_wq\n"); @@ -496,7 +498,9 @@ int target_xcopy_setup_pt(void) INIT_LIST_HEAD(&xcopy_pt_nacl.acl_list); INIT_LIST_HEAD(&xcopy_pt_nacl.acl_sess_list); memset(&xcopy_pt_sess, 0, sizeof(struct se_session)); - transport_init_session(&xcopy_pt_sess); + ret = transport_init_session(&xcopy_pt_sess); + if (ret < 0) + return ret; xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg; xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess; diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h index 58a03a094257..067da330ed9c 100644 --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h @@ -601,6 +601,7 @@ struct se_session { struct se_node_acl *se_node_acl; struct se_portal_group *se_tpg; void *fabric_sess_ptr; + struct percpu_ref cmd_count; struct list_head sess_list; struct list_head sess_acl_list; struct list_head sess_cmd_list; diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h index f4147b398431..eb9d0923c55c 100644 --- a/include/target/target_core_fabric.h +++ b/include/target/target_core_fabric.h @@ -116,7 +116,7 @@ struct se_session *target_setup_session(struct se_portal_group *, struct se_session *, void *)); void target_remove_session(struct se_session *); -void transport_init_session(struct se_session *); +int transport_init_session(struct se_session *se_sess); struct se_session *transport_alloc_session(enum target_prot_op); int transport_alloc_session_tags(struct se_session *, unsigned int, unsigned int);