[PATCH] scsi: target: alua: Hold tg_pt_gp_lock across the RTPG size check

[PATCH] scsi: target: alua: Hold tg_pt_gp_lock across the RTPG size check

[Qiliang Yuan]

target_emulate_report_target_port_groups() checks that each target port
group, with one descriptor per member port, fits in the allocation
length, and then writes a descriptor for every LUN on the group's list.

The size check reads tg_pt_gp_members without tg_pt_gp_lock, which is
only taken for the list walk. A LUN attached to the group in between,
e.g. by a LUN created through configfs, adds a port the check did not
account for, and its descriptor can be written past cmd->data_length.

Take tg_pt_gp_lock before the size check, so that the member count and
the list walked stay in sync.

Fixes: 6b20fa9aaf0c2 ("target: Fix REPORT TARGET PORT GROUPS handling with small allocation length")
Cc: stable@vger.kernel.org
Signed-off-by: Qiliang Yuan <qiliang.yuan@linux.dev>
---
 drivers/target/target_core_alua.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 140154d93c430..c9413e67b7f3f 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -166,9 +166,17 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
 	spin_lock(&dev->t10_alua.tg_pt_gps_lock);
 	list_for_each_entry(tg_pt_gp, &dev->t10_alua.tg_pt_gps_list,
 			tg_pt_gp_list) {
+		/*
+		 * Hold tg_pt_gp_lock from the size check to the end of the
+		 * descriptor list, so that LUNs joining the group cannot make
+		 * the list longer than the space checked for.
+		 */
+		spin_lock(&tg_pt_gp->tg_pt_gp_lock);
 		/* Skip empty port groups */
-		if (!tg_pt_gp->tg_pt_gp_members)
+		if (!tg_pt_gp->tg_pt_gp_members) {
+			spin_unlock(&tg_pt_gp->tg_pt_gp_lock);
 			continue;
+		}
 		/*
 		 * Check if the Target port group and Target port descriptor list
 		 * based on tg_pt_gp_members count will fit into the response payload.
@@ -178,6 +186,7 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
 		if ((off + 8 + (tg_pt_gp->tg_pt_gp_members * 4)) >
 		     cmd->data_length) {
 			rd_len += 8 + (tg_pt_gp->tg_pt_gp_members * 4);
+			spin_unlock(&tg_pt_gp->tg_pt_gp_lock);
 			continue;
 		}
 		/*
@@ -215,7 +224,6 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
 		buf[off++] = (tg_pt_gp->tg_pt_gp_members & 0xff);
 		rd_len += 8;
 
-		spin_lock(&tg_pt_gp->tg_pt_gp_lock);
 		list_for_each_entry(lun, &tg_pt_gp->tg_pt_gp_lun_list,
 				lun_tg_pt_gp_link) {
 			/*

---
base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
change-id: 20261110-bug-target-rtpg-oob-66d1ab0272c9

Best regards,
-- 
Qiliang Yuan <qiliang.yuan@linux.dev>