OSDN Git Service

scsi: target: tcmu: Userspace must not complete queued commands
authorBodo Stroesser <bstroesser@ts.fujitsu.com>
Mon, 18 May 2020 16:48:33 +0000 (18:48 +0200)
committerMartin K. Petersen <martin.petersen@oracle.com>
Wed, 20 May 2020 01:33:04 +0000 (21:33 -0400)
commit61fb2482216679b9e1e797440c148bb143a5040a
treec76f36494d0410a843a9d9645e6a8ebeac5bc096
parent5482d56bfedf1a2ce6450076e844676e20ab4e0a
scsi: target: tcmu: Userspace must not complete queued commands

When tcmu queues a new command - no matter whether in command ring or in
qfull_queue - a cmd_id from IDR udev->commands is assigned to the command.

If userspace sends a wrong command completion containing the cmd_id of a
command on the qfull_queue, tcmu_handle_completions() finds the command in
the IDR and calls tcmu_handle_completion() for it. This might do some nasty
things because commands in qfull_queue do not have a valid dbi list.

To fix this bug, we no longer add queued commands to the idr.  Instead the
cmd_id is assign when a command is written to the command ring.

Due to this change I had to adapt the source code at several places where
up to now an idr_for_each had been done.

[mkp: fix checkpatch warnings]

Link: https://lore.kernel.org/r/20200518164833.12775-1-bstroesser@ts.fujitsu.com
Acked-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/target/target_core_user.c