Brian M 67d2469c9b scst_dlm: Fix use-after-free by waiting for lkb destruction
When scst_dlm_unlock_wait() timed out, the caller could proceed to
free the containing storage of @lksb while DLM still held a reference
to it in lkb->lkb_lksb. A subsequently delivered AST -- e.g. a
recovery-synthesized UNLOCK_REPLY for a departed peer -- would then
write sb_status into freed memory.

Make scst_dlm_remove_lock() honor its contract on every path: after
the convert-to-NL clean-release step, issue
dlm_unlock(DLM_LKF_FORCEUNLOCK) and loop on the completion until a
destroying CAST (sb_status == -DLM_EUNLOCK) is observed. FORCEUNLOCK
ensures that such a CAST arrives even if an earlier operation is
still in flight or a peer is departing, since
dlm_recover_waiters_pre() synthesizes the reply in the latter case.
Non-destroying CASTs from previously canceled converts are logged
and the wait continues.

Route the per-registrant teardown (scst_dlm_pr_rm_reg_ls), the
remote-UA teardown (scst_dlm_rm_rem_ua_ls), and the remaining
stack-allocated lksb teardown sites through scst_dlm_remove_lock()
so they all observe the destroying CAST before their storage may
be reused. As a side benefit, those sites gain the convert-to-NL
step that preserves LVB validity on peers per the DLM EX/PW
release rule.
2026-05-25 13:38:38 +03:00
2025-12-29 13:06:44 +03:00
2026-04-12 15:38:24 +03:00
2025-12-29 13:06:44 +03:00

SCST

Coverity Downloads

Overview

This is the source code repository of the SCST project. SCST is a collection of Linux kernel drivers that implement SCSI target functionality. The SCST project includes:

  1. The SCST core in the scst/ subdirectory.
  2. A tool for loading, saving and modifying the SCST configuration in directory scstadmin/.
  3. Several SCSI target drivers in the directories iscsi-scst/, qla2x00t/, srpt/, scst_local/ and fcst/.
  4. User space programs in the usr/ subdirectory, e.g. fileio_tgt.
  5. Various documentation in the doc/ subdirectory.

Instructions for building and installing SCST are available in the INSTALL.md file.

QLogic target driver

Two QLogic target drivers are included in the SCST project.

The default driver is located in qla2x00t-32gbit directory and it supports up to 32 Gb/s FC. It is the newer one.

May anyone wish to switch back to the older driver that only supported up to 16 Gb/s adapters, it is located in qla2x00t directory. To make use of the older driver build scst with environment variable QLA_32GBIT=no set.

Vladislav Bolkhovitin vst@vlnb.net, http://scst.sourceforge.net

Sourceforge achievements

Description
No description provided
Readme 33 MiB
Languages
C 90.1%
Perl 4.2%
Shell 1.8%
HTML 1.7%
Makefile 1.2%
Other 0.9%