Bryant G Ly
f5957dade4
scsi: target: Fix fortify_panic kernel exception
memcmp() requires the two buffers passed as arguments to be at least
'size' bytes long, otherwise a fortify_panic will trigger.
Use memchr_inv() instead of memcmp() to determine whether the received
payload is zeroed or not.
The bug was found by running a block backstore via LIO.
[ 496.212958] Call Trace:
[ 496.212960] [c0000007e58e3800] [c000000000cbbefc] fortify_panic+0x24/0x38 (unreliable)
[ 496.212965] [c0000007e58e3860] [d00000000f150c28] iblock_execute_write_same+0x3b8/0x3c0 [target_core_iblock]
[ 496.212976] [c0000007e58e3910] [d000000006c737d4] __target_execute_cmd+0x54/0x150 [target_core_mod]
[ 496.212982] [c0000007e58e3940] [d000000006d32ce4] ibmvscsis_write_pending+0x74/0xe0 [ibmvscsis]
[ 496.212991] [c0000007e58e39b0] [d000000006c74fc8] transport_generic_new_cmd+0x318/0x370 [target_core_mod]
[ 496.213001] [c0000007e58e3a30] [d000000006c75084] transport_handle_cdb_direct+0x64/0xd0 [target_core_mod]
[ 496.213011] [c0000007e58e3aa0] [d000000006c75298] target_submit_cmd_map_sgls+0x1a8/0x320 [target_core_mod]
[ 496.213021] [c0000007e58e3b30] [d000000006c75458] target_submit_cmd+0x48/0x60 [target_core_mod]
[ 496.213026] [c0000007e58e3bd0] [d000000006d34c20] ibmvscsis_scheduler+0x370/0x600 [ibmvscsis]
[ 496.213031] [c0000007e58e3c90] [c00000000013135c] process_one_work+0x1ec/0x580
[ 496.213035] [c0000007e58e3d20] [c000000000131798] worker_thread+0xa8/0x600
[ 496.213039] [c0000007e58e3dc0] [c00000000013a468] kthread+0x168/0x1b0
[ 496.213044] [c0000007e58e3e30] [c00000000000b528] ret_from_kernel_thread+0x5c/0xb4
[mkp: tweaked commit message]
Fixes: 2237498f0b ("target/iblock: Convert WRITE_SAME to blkdev_issue_zeroout")
Signed-off-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
Reviewed-by: Steven Royer <seroyer@linux.vnet.ibm.com>
Tested-by: Taylor Jakobson <tjakobs@us.ibm.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: <stable@vger.kernel.org> # v4.13+
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
|
2018-04-20 19:24:01 -04:00 |
| .. |
|
iscsi
|
for-4.17/block-20180402
|
2018-04-05 14:27:02 -07:00 |
|
loopback
|
target/tcm_loop: Use blk_queue_flag_set()
|
2018-03-08 14:13:48 -07:00 |
|
sbp
|
sbp-target: Delete an error message for a failed memory allocation in three functions
|
2018-01-12 15:07:21 -08:00 |
|
tcm_fc
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
Kconfig
|
target: Use sgl_alloc_order() and sgl_free()
|
2018-01-06 09:18:00 -07:00 |
|
Makefile
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
target_core_alua.c
|
target: fix ALUA state file path truncation
|
2017-11-04 15:00:30 -07:00 |
|
target_core_alua.h
|
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
|
2017-11-24 19:19:20 -10:00 |
|
target_core_configfs.c
|
target core: add device action configfs files
|
2018-01-16 18:05:04 -08:00 |
|
target_core_device.c
|
target: fix destroy device in target_configure_device
|
2018-01-18 01:21:11 -08:00 |
|
target_core_fabric_configfs.c
|
target: Move a declaration of a global variable into a header file
|
2017-11-04 15:15:30 -07:00 |
|
target_core_fabric_lib.c
|
target-core: don't use "const char*" for a buffer that is written to
|
2018-01-12 15:07:09 -08:00 |
|
target_core_file.c
|
target/file: Do not return error for UNMAP if length is zero
|
2017-11-04 14:45:16 -07:00 |
|
target_core_file.h
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
target_core_hba.c
|
|
|
|
target_core_iblock.c
|
scsi: target: Fix fortify_panic kernel exception
|
2018-04-20 19:24:01 -04:00 |
|
target_core_iblock.h
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
target_core_internal.h
|
target core: add device action configfs files
|
2018-01-16 18:05:04 -08:00 |
|
target_core_pr.c
|
target-core: don't use "const char*" for a buffer that is written to
|
2018-01-12 15:07:09 -08:00 |
|
target_core_pr.h
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
target_core_pscsi.c
|
scsi: target: fix crash with iscsi target and dvd
|
2018-04-19 00:41:03 -04:00 |
|
target_core_pscsi.h
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
target_core_rd.c
|
target: break up free_device callback
|
2017-07-06 23:11:37 -07:00 |
|
target_core_rd.h
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
target_core_sbc.c
|
target: don't call an unmap callback if a range length is zero
|
2018-01-12 15:07:28 -08:00 |
|
target_core_spc.c
|
target: Fix cmd size for PR-OUT in passthrough_parse_cdb
|
2017-07-09 20:58:49 -07:00 |
|
target_core_stat.c
|
target: make config_item_type const
|
2017-10-19 16:15:17 +02:00 |
|
target_core_tmr.c
|
target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK
|
2017-11-07 19:50:24 -08:00 |
|
target_core_tpg.c
|
target: Fix node_acl demo-mode + uncached dynamic shutdown regression
|
2017-08-09 20:55:19 -07:00 |
|
target_core_transport.c
|
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
|
2018-02-09 14:49:46 -08:00 |
|
target_core_ua.c
|
|
|
|
target_core_ua.h
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
target_core_user.c
|
tcmu: Fix trailing semicolon
|
2018-01-18 01:21:24 -08:00 |
|
target_core_xcopy.c
|
xcopy: loop over devices using idr helper
|
2017-07-06 23:11:40 -07:00 |
|
target_core_xcopy.h
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |