[PATCH 0/2] target: OOPS in target_fabric_port_link on v3.7.4 and v3.4.27

[PATCH 0/2] target: OOPS in target_fabric_port_link on v3.7.4 and v3.4.27

[Ben Peddell]

There is an OOPS in target_fabric_port_link due to a use before
initialization error.

commit 0ff8754981261a80f4b77db2536dfea92c2d4539 (target: Add link_magic
for fabric allow_link destination target_items) as merged in the
linux-3.7.y and linux-3.4.y branches relies on one of the changes that
occurred in commit 0fd97ccf45be26fb01b3a412f1f6c6b5044b2f16 (Simplify
the code a lot by killing the superflous struct se_subsystem_dev).
Without that change, dev is dereferenced before it is initialized.

Commit 0fd97ccf45be26fb01b3a412f1f6c6b5044b2f16 looks too invasive,
which I would guess would be why it wasn't merged in.

One option would be to move the dev->dev_link_magic test to after dev is
initialized, as presented the patches I will be following up with.

An alternative that will resolve this OOPS is to revert commit
fdf9d862969f1be18814273b03fb9497ec2dbdae (target: Add link_magic for
fabric allow_link destination target_items) on branch linux-3.7.y, and
revert commit 92a7389317838f3338466df0c0e3d23ad33cb1f4 (target: Add
link_magic for fabric allow_link destination target_items) on branch
linux-3.4.y

[PATCH 1/2] 3.4.y target: Move dev->dev_link_magic check

[Ben Peddell]

Commit fdf9d862969f1be18814273b03fb9497ec2dbdae (target: Add link_magic
for fabric allow_link destination target_items) applied without commit
0fd97ccf45be26fb01b3a412f1f6c6b5044b2f16 (Simplify the code a lot by
killing the superflous struct se_subsystem_dev) has the
dev->dev_link_magic check before dev is initialized in
target_fabric_port_link.  This patch moves the dev->dev_link_magic
check to after dev is initialized.

Signed-off-by: Ben Peddell <klightspeed@killerwolves.net>
---
 drivers/target/target_core_fabric_configfs.c |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index b009b89..31de881 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -752,12 +752,6 @@ static int target_fabric_port_link(
 	struct target_fabric_configfs *tf;
 	int ret;
 
-	if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
-		pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
-			" %p to struct se_device: %p\n", se_dev_ci, dev);
-		return -EFAULT;
-	}
-
 	tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
 	se_tpg = container_of(to_config_group(tpg_ci),
 				struct se_portal_group, tpg_group);
@@ -776,6 +770,12 @@ static int target_fabric_port_link(
 		goto out;
 	}
 
+	if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
+		pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
+			" %p to struct se_device: %p\n", se_dev_ci, dev);
+		return -EFAULT;
+	}
+
 	lun_p = core_dev_add_lun(se_tpg, dev->se_hba, dev,
 				lun->unpacked_lun);
 	if (IS_ERR(lun_p)) {
-- 
1.7.8.6

[PATCH 2/2] 3.7.y target: Move dev->dev_link_magic check

[Ben Peddell]

Commit fdf9d862969f1be18814273b03fb9497ec2dbdae (target: Add link_magic
for fabric allow_link destination target_items) applied without commit
0fd97ccf45be26fb01b3a412f1f6c6b5044b2f16 (Simplify the code a lot by
killing the superflous struct se_subsystem_dev) has the
dev->dev_link_magic check before dev is initialized in
target_fabric_port_link.  This patch moves the dev->dev_link_magic
check to after dev is initialized.

Signed-off-by: Ben Peddell <klightspeed@killerwolves.net>
---
 drivers/target/target_core_fabric_configfs.c |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index a55f91a..d7bb0c0 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -751,12 +751,6 @@ static int target_fabric_port_link(
 	struct target_fabric_configfs *tf;
 	int ret;
 
-	if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
-		pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
-			" %p to struct se_device: %p\n", se_dev_ci, dev);
-		return -EFAULT;
-	}
-
 	tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
 	se_tpg = container_of(to_config_group(tpg_ci),
 				struct se_portal_group, tpg_group);
@@ -775,6 +769,12 @@ static int target_fabric_port_link(
 		goto out;
 	}
 
+	if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
+		pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
+			" %p to struct se_device: %p\n", se_dev_ci, dev);
+		return -EFAULT;
+	}
+
 	lun_p = core_dev_add_lun(se_tpg, dev, lun->unpacked_lun);
 	if (IS_ERR(lun_p)) {
 		pr_err("core_dev_add_lun() failed\n");
-- 
1.7.8.6

Re: [PATCH 0/2] target: OOPS in target_fabric_port_link on v3.7.4 and v3.4.27

[Ben Peddell]

On 3/02/2013 6:31 PM, Ben Peddell wrote:
> There is an OOPS in target_fabric_port_link due to a use before
> initialization error.
> 
> commit 0ff8754981261a80f4b77db2536dfea92c2d4539 (target: Add link_magic
> for fabric allow_link destination target_items) as merged in the
> linux-3.7.y and linux-3.4.y branches relies on one of the changes that
> occurred in commit 0fd97ccf45be26fb01b3a412f1f6c6b5044b2f16 (Simplify
> the code a lot by killing the superflous struct se_subsystem_dev).
> Without that change, dev is dereferenced before it is initialized.
> 
> Commit 0fd97ccf45be26fb01b3a412f1f6c6b5044b2f16 looks too invasive,
> which I would guess would be why it wasn't merged in.
> 
> One option would be to move the dev->dev_link_magic test to after dev is
> initialized, as presented the patches I will be following up with.
> 
> An alternative that will resolve this OOPS is to revert commit
> fdf9d862969f1be18814273b03fb9497ec2dbdae (target: Add link_magic for
> fabric allow_link destination target_items) on branch linux-3.7.y, and
> revert commit 92a7389317838f3338466df0c0e3d23ad33cb1f4 (target: Add
> link_magic for fabric allow_link destination target_items) on branch
> linux-3.4.y

I should have looked in the stable queue first - an equivalent to my
patch is already in the stable queue for 3.4 and 3.7