wenlxieandGleb Chesnokov 96457a8187 scst_user: Pin cached user buffers so they survive fork()
dev_user_map_buf() takes the handler's buffer pages with
get_user_pages(FOLL_WRITE). With SCST_USER_MEM_REUSE_* the buffer stays
cached in the SGV pool and is reused by later commands, so SCST keeps
these page references for a long time.

A page reference does not keep the handler and SCST on the same page
across fork(). After the handler forks, its private pages are shared
copy-on-write, and the handler's next write to a cached buffer moves the
handler to a new copy while SCST keeps using the old page. SCST then
returns stale data to the initiator. For READ CAPACITY it also takes the
stale bytes as the block length and changes the device geometry, for
example:

  1 << 30 != 1145132097
  scst_user: ...: Changed block shift from 12 into 30 / 30

Any fork() in the handler triggers this, including a crash reporter that
clones a minidump writer without CLONE_VM, system() and popen().

Pin the pages with FOLL_LONGTERM instead. Since Linux 5.9 (commit
70e806e4e645, "mm: Do early cow for pinned pages during fork() for
ptes"), fork() gives the child a copy of a pinned anonymous page, so the
handler and SCST keep sharing the same page. pin_user_pages() itself is
older, but before 5.9 fork() write-protects pinned pages like any other,
so pinning alone does not help there. Release them with
unpin_user_pages(), marking them dirty with SetPageDirty() as before.
unpin_user_pages_dirty_lock() is not usable here: it takes the page
lock, and on_free_cmd() can release an uncached buffer in atomic
context. Use the pin from Linux 5.9; older kernels, including
distribution kernels based on them, keep the existing code.

doc/scst_user_spec.sgml so far required handlers that fork() to mark
their data buffers MADV_DONTFORK. With the pin that is only needed on
kernels older than 5.9, and for private HugeTLB buffers on kernels older
than 5.12: fork() copies pinned HugeTLB pages only since commit
4eae4efa2c29 ("hugetlb: do early cow when page pinned on src mm"), which
5.10.y and 5.11.y do not have. Update that note and the source comment
accordingly. Also document that data
buffers should be anonymous or shared memory: since Linux 6.5 the kernel
refuses a long term writable pin of a MAP_SHARED mapping of a regular
file on a file system with writeback, and a command using such a buffer
then fails with INTERNAL TARGET FAILURE sense. Such a buffer was not
safe with get_user_pages() either, because SCST could write to it while
the file system wrote it back.

Add scst-USER-buffers, which maps a KUnit-owned user buffer with
dev_user_map_buf() and releases it with dev_user_unmap_buf() with
interrupts disabled, checking that the pages are unpinned and marked
dirty only after a write.
2026-10-20 08:43:01 +03:00

SCST

Coverity Downloads

Overview

This is the source code repository of the SCST project. SCST is a collection of Linux kernel drivers that implement SCSI target functionality. The SCST project includes:

  1. The SCST core in the scst/ subdirectory.
  2. A tool for loading, saving and modifying the SCST configuration in directory scstadmin/.
  3. Several SCSI target drivers in the directories iscsi-scst/, qla2x00t-32gbit/, qla2x00t/, srpt/, scst_local/ and fcst/.
  4. User space programs in the usr/ subdirectory, e.g. fileio_tgt.
  5. Various documentation in the doc/ subdirectory.

Documentation

Current master packages

Prebuilt x86_64 packages from the latest successfully published master build are available in the rolling master-rpm prerelease. These are development snapshots, not SCST releases.

The snapshot contains RPM bundles for selected Rocky Linux and Oracle Linux UEK kernels. It also contains Ubuntu LTS bundles with scst-dkms, scstadmin and iscsi-scst binary packages and their Debian source package files. Exact distribution releases and RPM kernel versions are included in the asset names. Every .tar.gz bundle has a matching .sha256 file. The complete snapshot is replaced after each successful package workflow for the current master commit.

QLogic target driver

Two QLogic target drivers are included in the SCST project.

The default driver is located in the qla2x00t-32gbit directory. It is the newer one.

May anyone wish to switch back to the older driver that only supported up to 16 Gb/s adapters, it is located in qla2x00t directory. To make use of the older driver build scst with environment variable QLA_32GBIT=no set.

Vladislav Bolkhovitin vst@vlnb.net, http://scst.sourceforge.net

Sourceforge achievements

S
Description
No description provided
Readme
38 MiB
Languages
C 82.7%
Python 5.5%
Perl 3.6%
Go 2.9%
Shell 1.8%
Other 3.4%