mirrors/scst
1
0
Fork 0
mirror of https://github.com/SCST-project/scst.git synced 2026-05-17 18:51:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

qla2x00t-32gbit: Fix TMR failure handling

Browse Source 
(target mode)

If handle_tmr() fails:

- The code for QLA_TGT_ABTS results in memory-use-after-free and
  double-free:
	qlt_do_tmr_work()
		qlt_build_abts_resp_iocb()
			qpair->req->outstanding_cmds[h] = (srb_t *)mcmd;
		mempool_free(mcmd, qla_tgt_mgmt_cmd_mempool); FIRST FREE
	qlt_handle_abts_completion()
		mcmd = qlt_ctio_to_cmd()
			cmd = req->outstanding_cmds[h];
			return cmd;
		vha  = mcmd->vha; USE-AFTER-FREE
		ha->tgt.tgt_ops->free_mcmd(mcmd); SECOND FREE

- qlt_send_busy() makes no sense because it sends a SCSI command
  response instead of a TMR response.

Instead just call qlt_xmit_tm_rsp() to send a TMR failed response,
since that code is well-tested and handles a number of corner cases.
But it would be incorrect to call ha->tgt.tgt_ops->free_mcmd() after
handle_tmr() failed, so add a flag to mcmd indicating the proper way to
free the mcmd so that qlt_xmit_tm_rsp() can be used for both cases.

Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Link: https://patch.msgid.link/09a1ff3d-6738-4953-a31b-10e89c540462@cybernetics.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[ commit 3d56983cc6f0 upstream ]
This commit is contained in:
Tony Battersby
2025-10-14 11:44:23 +03:00
committed by Gleb Chesnokov
parent 33bfeab7d0
commit f9023c31ef
3 changed files with 27 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
qla2x00t-32gbit/qla_os.c
View File

@@ -1943,7 +1943,7 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
* Currently, only ABTS response gets on the
* outstanding_cmds[]
*/
ha->tgt.tgt_ops->free_mcmd(
qlt_free_ul_mcmd(ha,
(struct qla_tgt_mgmt_cmd *) sp);
break;
default:

56
qla2x00t-32gbit/qla_target.c
View File

@@ -2020,7 +2020,6 @@ static void qlt_do_tmr_work(struct work_struct *work)
struct qla_hw_data *ha = mcmd->vha->hw;
int rc;
uint32_t tag;
unsigned long flags;
switch (mcmd->tmr_func) {
case QLA_TGT_ABTS:
@@ -2035,34 +2034,12 @@ static void qlt_do_tmr_work(struct work_struct *work)
mcmd->tmr_func, tag);
if (rc != 0) {
spin_lock_irqsave(mcmd->qpair->qp_lock_ptr, flags);
switch (mcmd->tmr_func) {
case QLA_TGT_ABTS:
mcmd->fc_tm_rsp = FCP_TMF_REJECTED;
qlt_build_abts_resp_iocb(mcmd);
break;
case QLA_TGT_LUN_RESET:
case QLA_TGT_CLEAR_TS:
case QLA_TGT_ABORT_TS:
case QLA_TGT_CLEAR_ACA:
case QLA_TGT_TARGET_RESET:
qlt_send_busy(mcmd->qpair, &mcmd->orig_iocb.atio,
qla_sam_status);
break;
case QLA_TGT_ABORT_ALL:
case QLA_TGT_NEXUS_LOSS_SESS:
case QLA_TGT_NEXUS_LOSS:
qlt_send_notify_ack(mcmd->qpair,
&mcmd->orig_iocb.imm_ntfy, 0, 0, 0, 0, 0, 0);
break;
}
spin_unlock_irqrestore(mcmd->qpair->qp_lock_ptr, flags);
ql_dbg(ql_dbg_tgt_mgt, mcmd->vha, 0xf052,
"qla_target(%d): tgt_ops->handle_tmr() failed: %d\n",
mcmd->vha->vp_idx, rc);
mempool_free(mcmd, qla_tgt_mgmt_cmd_mempool);
mcmd->flags |= QLA24XX_MGMT_LLD_OWNED;
mcmd->fc_tm_rsp = FCP_TMF_FAILED;
qlt_xmit_tm_rsp(mcmd);
}
}
@@ -2257,6 +2234,21 @@ void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *mcmd)
}
EXPORT_SYMBOL(qlt_free_mcmd);
/*
* If the upper layer knows about this mgmt cmd, then call its ->free_cmd()
* callback, which will eventually call qlt_free_mcmd(). Otherwise, call
* qlt_free_mcmd() directly.
*/
void qlt_free_ul_mcmd(struct qla_hw_data *ha, struct qla_tgt_mgmt_cmd *mcmd)
{
if (!mcmd)
return;
if (mcmd->flags & QLA24XX_MGMT_LLD_OWNED)
qlt_free_mcmd(mcmd);
else
ha->tgt.tgt_ops->free_mcmd(mcmd);
}
/*
* ha->hardware_lock supposed to be held on entry. Might drop it, then
* reacquire
@@ -2349,12 +2341,12 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
"RESET-TMR online/active/old-count/new-count = %d/%d/%d/%d.\n",
vha->flags.online, qla2x00_reset_active(vha),
mcmd->reset_count, qpair->chip_reset);
ha->tgt.tgt_ops->free_mcmd(mcmd);
qlt_free_ul_mcmd(ha, mcmd);
spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
return;
}
if (mcmd->flags == QLA24XX_MGMT_SEND_NACK) {
if (mcmd->flags & QLA24XX_MGMT_SEND_NACK) {
switch (mcmd->orig_iocb.imm_ntfy.u.isp24.status_subcode) {
case ELS_LOGO:
case ELS_PRLO:
@@ -2387,7 +2379,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
* qlt_xmit_tm_rsp() returns here..
*/
if (free_mcmd)
ha->tgt.tgt_ops->free_mcmd(mcmd);
qlt_free_ul_mcmd(ha, mcmd);
spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
}
@@ -5809,7 +5801,7 @@ static void qlt_handle_abts_completion(struct scsi_qla_host *vha,
if (le32_to_cpu(entry->error_subcode1) == 0x1E &&
le32_to_cpu(entry->error_subcode2) == 0) {
if (qlt_chk_unresolv_exchg(vha, rsp->qpair, entry)) {
ha->tgt.tgt_ops->free_mcmd(mcmd);
qlt_free_ul_mcmd(ha, mcmd);
return;
}
qlt_24xx_retry_term_exchange(vha, rsp->qpair,
@@ -5820,10 +5812,10 @@ static void qlt_handle_abts_completion(struct scsi_qla_host *vha,
vha->vp_idx, entry->compl_status,
entry->error_subcode1,
entry->error_subcode2);
ha->tgt.tgt_ops->free_mcmd(mcmd);
qlt_free_ul_mcmd(ha, mcmd);
}
} else if (mcmd) {
ha->tgt.tgt_ops->free_mcmd(mcmd);
qlt_free_ul_mcmd(ha, mcmd);
}
}

2
qla2x00t-32gbit/qla_target.h
View File

@@ -1006,6 +1006,7 @@ struct qla_tgt_mgmt_cmd {
unsigned int flags;
#define QLA24XX_MGMT_SEND_NACK BIT_0
#define QLA24XX_MGMT_ABORT_IO_ATTR_VALID BIT_1
#define QLA24XX_MGMT_LLD_OWNED BIT_2
uint32_t reset_count;
struct work_struct work;
uint64_t unpacked_lun;
@@ -1102,6 +1103,7 @@ extern int qlt_abort_cmd(struct qla_tgt_cmd *);
void qlt_send_term_exchange(struct qla_qpair *qpair,
struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked);
extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
void qlt_free_ul_mcmd(struct qla_hw_data *ha, struct qla_tgt_mgmt_cmd *mcmd);
extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
extern void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd);