From 0655c3e76a9f35bf8cd1b0216743f24f7a87baa2 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 18 Mar 2019 00:23:05 +0000 Subject: [PATCH 1/2] iscsi-scst: Fix a use-after-free Avoid that KASAN reports the following complaint: BUG: KASAN: slab-out-of-bounds in f/0xdc4 [iscsi_scst] Read of size 8 at addr ffff888be35fd0ec by task iscsiwr0_71/3289 CPU: 42 PID: 3289 Comm: iscsiwr0_71 Tainted: G sos.debug #1 Hardware name: To be filled by O.E.M. Call Trace: dump_stack+0x8e/0xc8 print_address_description+0x73/0x238 kasan_report+0x228/0x251 check_memory_region+0x126/0x12c __asan_loadN+0xf/0x11 write_data+0x5df/0xdc4 [iscsi_scst] iscsi_do_send+0x20/0x67 [iscsi_scst] iscsi_send+0x1f0/0x574 [iscsi_scst] scst_do_job_wr+0x2ef/0x549 [iscsi_scst] istwr+0x366/0x4a2 [iscsi_scst] kthread+0x1df/0x1ef ret_from_fork+0x3a/0x50 Allocated by task 3063: save_stack_trace+0x1b/0x1d kasan_kmalloc.part.1+0x62/0xee kasan_kmalloc+0x7f/0x8b kasan_slab_alloc+0x12/0x14 kmem_cache_alloc+0x13d/0x27a mempool_alloc_slab+0x15/0x17 mempool_alloc+0xdb/0x1f3 scst_alloc_aen+0x96/0x223 [scst] scst_gen_aen_or_ua+0x16b/0x3d2 [scst] scst_capacity_data_changed+0x147/0x1cd [scst] vdev_size_process_store+0x1b5/0x1f4 [scst_vdisk] scst_process_sysfs_works+0x187/0x2a1 [scst] sysfs_work_thread_fn+0x301/0x42b [scst] kthread+0x1df/0x1ef ret_from_fork+0x3a/0x50 Reported-by: Marc Smith git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8056 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- iscsi-scst/kernel/nthread.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/iscsi-scst/kernel/nthread.c b/iscsi-scst/kernel/nthread.c index d936d53a1..0392a029f 100644 --- a/iscsi-scst/kernel/nthread.c +++ b/iscsi-scst/kernel/nthread.c @@ -1189,7 +1189,8 @@ retry: sock = conn->sock; - if ((write_cmnd->parent_req->scst_cmd != NULL) && + if (write_cmnd->parent_req->scst_cmd && + write_cmnd->parent_req->scst_state != ISCSI_CMD_STATE_AEN && scst_cmd_get_dh_data_buff_alloced(write_cmnd->parent_req->scst_cmd)) sock_sendpage = sock_no_sendpage; else From 3b76bc5b1f3c6654c9745f8edf37db770aefc63e Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 18 Mar 2019 00:24:56 +0000 Subject: [PATCH 2/2] Use KERNEL_DS instead of get_ds() This patch is necessary to make SCST work with Linux kernel v5.1 and does not change any functionality. See also upstream commit 736706bee329 ("get rid of legacy 'get_ds()' function"). git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8057 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- iscsi-scst/kernel/conn.c | 2 +- iscsi-scst/kernel/iscsi.c | 2 +- iscsi-scst/kernel/nthread.c | 2 +- scst/src/dev_handlers/scst_vdisk.c | 12 ++++++------ scst/src/scst_lib.c | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/iscsi-scst/kernel/conn.c b/iscsi-scst/kernel/conn.c index fb5231fc6..7e6a96611 100644 --- a/iscsi-scst/kernel/conn.c +++ b/iscsi-scst/kernel/conn.c @@ -787,7 +787,7 @@ static int conn_setup_sock(struct iscsi_conn *conn) conn->sock->sk->sk_user_data = conn; oldfs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); conn->sock->ops->setsockopt(conn->sock, SOL_TCP, TCP_NODELAY, (void __force __user *)&opt, sizeof(opt)); set_fs(oldfs); diff --git a/iscsi-scst/kernel/iscsi.c b/iscsi-scst/kernel/iscsi.c index 105de8f4d..3afad2ed4 100644 --- a/iscsi-scst/kernel/iscsi.c +++ b/iscsi-scst/kernel/iscsi.c @@ -2899,7 +2899,7 @@ static inline void set_cork(struct socket *sock, int on) mm_segment_t oldfs; oldfs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (void __force __user *)&opt, sizeof(opt)); set_fs(oldfs); diff --git a/iscsi-scst/kernel/nthread.c b/iscsi-scst/kernel/nthread.c index 0392a029f..729324b26 100644 --- a/iscsi-scst/kernel/nthread.c +++ b/iscsi-scst/kernel/nthread.c @@ -565,7 +565,7 @@ restart: #endif oldfs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); res = sock_recvmsg(conn->sock, msg, #if SOCK_RECVMSG_HAS_FOUR_ARGS read_size, diff --git a/scst/src/dev_handlers/scst_vdisk.c b/scst/src/dev_handlers/scst_vdisk.c index e280cea16..385969140 100644 --- a/scst/src/dev_handlers/scst_vdisk.c +++ b/scst/src/dev_handlers/scst_vdisk.c @@ -1720,7 +1720,7 @@ static int vdisk_format_dif(struct scst_cmd *cmd, uint64_t start_lba, iv[i].iov_base = (uint8_t __force __user *)data_buf; old_fs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); loff = start_lba << SCST_DIF_TAG_SHIFT; left = blocks << SCST_DIF_TAG_SHIFT; @@ -3003,7 +3003,7 @@ static ssize_t fileio_read_sync(struct file *fd, void *buf, size_t len, ssize_t ret; old_fs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); ret = scst_read(fd, buf, len, loff); set_fs(old_fs); @@ -5394,7 +5394,7 @@ static int vdev_read_dif_tags(struct vdisk_cmd_params *p) max_iv_count = p->sync.iv_count; old_fs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); tags_sg = NULL; loff = (p->loff >> cmd->dev->block_shift) << SCST_DIF_TAG_SHIFT; @@ -5515,7 +5515,7 @@ static int vdev_write_dif_tags(struct vdisk_cmd_params *p) max_iv_count = p->sync.iv_count; old_fs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); tags_sg = NULL; loff = (p->loff >> cmd->dev->block_shift) << SCST_DIF_TAG_SHIFT; @@ -5701,7 +5701,7 @@ static enum compl_status_e fileio_exec_write(struct vdisk_cmd_params *p) } old_fs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); while (1) { iv_count = 0; @@ -6415,7 +6415,7 @@ static enum compl_status_e fileio_exec_read(struct vdisk_cmd_params *p) } old_fs = get_fs(); - set_fs(get_ds()); + set_fs(KERNEL_DS); while (1) { iv_count = 0; diff --git a/scst/src/scst_lib.c b/scst/src/scst_lib.c index dabd921aa..9c86e5be4 100644 --- a/scst/src/scst_lib.c +++ b/scst/src/scst_lib.c @@ -5928,7 +5928,7 @@ static void scst_complete_request_sense(struct scst_cmd *req_cmd) static int scst_cmp_fs_ds(void) { mm_segment_t fs = get_fs(); - mm_segment_t ds = get_ds(); + mm_segment_t ds = KERNEL_DS; return memcmp(&fs, &ds, sizeof(fs)); }