Re: [PATCH 2/2] xen/scsiback: free the command tag on the TMR submit-failure path

[Juergen Gross <jgross@suse.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1337 bytes --]

On 11.06.26 14:30, Michael Bommarito wrote:
> scsiback_device_action() obtains a command tag in
> scsiback_get_pend_req() and submits a task-management request with
> target_submit_tmr(). When target_submit_tmr() fails it returns < 0
> and scsiback jumps to the err: label, which sends a response but
> frees nothing, leaking the tag.
> 
> Impact: a pvSCSI guest can leak the command tags of a LUN's
> session, stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or
> RESET requests whenever target_submit_tmr() fails.
> 
> transport_generic_free_cmd() cannot be used here. By the time
> target_submit_tmr() returns an error it has already run
> __target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on
> its target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req
> via core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and
> the pointer dangling. Letting the command release run
> target_free_cmd_mem() would then double-free se_tmr_req.
> 
> Use the same helper, which returns just the tag, on this path too.
> 
> Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>

Reviewed-by: Juergen Gross <jgross@suse.com>


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]