linux-stable.git/drivers/target/loopback/tcm_loop.c, branch linux-5.4.y

scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()

2025-12-03T11:45:20+00:00

commit e6965188f84a7883e6a0d3448e86b0cf29b24dfc upstream.

If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we
attempt to dereference it in tcm_loop_tpg_address_show() we will get a
segfault, see below for an example. So, check tl_hba->sh before
dereferencing it.

  Unable to allocate struct scsi_host
  BUG: kernel NULL pointer dereference, address: 0000000000000194
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1
  Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024
  RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]
...
  Call Trace:
   
   configfs_read_iter+0x12d/0x1d0 [configfs]
   vfs_read+0x1b5/0x300
   ksys_read+0x6f/0xf0
...

Cc: stable@vger.kernel.org
Fixes: 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs")
Signed-off-by: Hamza Mahfooz 
Reviewed-by: Chaitanya Kulkarni 
Reviewed-by: Allen Pais 
Link: https://patch.msgid.link/1762370746-6304-1-git-send-email-hamzamahfooz@linux.microsoft.com
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()

2022-11-25T16:42:20+00:00

[ Upstream commit bc68e428d4963af0201e92159629ab96948f0893 ]

If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated
by dev_set_name() need be freed. As comment of device_register() says, it
should use put_device() to give up the reference in the error path. So fix
this by calling put_device(), then the name can be freed in kobject_cleanup().
The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need
goto error label in this case.

Fixes: 3703b2c5d041 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module")
Signed-off-by: Yang Yingliang 
Link: https://lore.kernel.org/r/20221115015042.3652261-1-yangyingliang@huawei.com
Reviewed-by: Mike Christie 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: target: loopback: Fix READ with data and sensebytes

2020-06-24T15:50:25+00:00

[ Upstream commit c68a56736c129f5dd1632856956f9c3e04bae200 ]

We use tcm_loop with tape emulations running on tcmu.

In case application reads a short tape block with a longer READ, or a long
tape block with a short READ, according to SCC spec data has to be
tranferred _and_ sensebytes with ILI set and information field containing
the residual count. Similar problem also exists when using fixed block
size in READ.

Up to now tcm_loop is not prepared to handle sensebytes if input data is
provided, as in tcm_loop_queue_data_in() it only sets SAM_STAT_GOOD and, if
necessary, the residual count.

To fix the bug, the same handling for sensebytes as present in
tcm_loop_queue_status() must be done in tcm_loop_queue_data_in() also.

After adding this handling, the two function now are nearly identical, so I
created a single function with two wrappers.

Link: https://lore.kernel.org/r/20200428182617.32726-1-bstroesser@ts.fujitsu.com
Signed-off-by: Bodo Stroesser 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: remove bidirectional command support

2019-02-06T02:29:21+00:00

No real need for bidi support once the OSD code is gone.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Jens Axboe 
Signed-off-by: Martin K. Petersen

scsi: target/core: Remove the write_pending_status() callback function

2019-02-05T02:23:59+00:00

Due to the patch that makes TMF handling synchronous the
write_pending_status() callback function is no longer called.  Hence remove
it.

Acked-by: Felipe Balbi 
Reviewed-by: Sagi Grimberg 
Reviewed-by: Andy Grover 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Reviewed-by: Bryant G. Ly 
Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Himanshu Madhani 
Cc: Quinn Tran 
Cc: Saurav Kashyap 
Cc: Michael S. Tsirkin 
Cc: Juergen Gross 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: remove the use_clustering flag

2018-12-19T04:19:21+00:00

The same effects can be achieved by setting the dma_boundary to
PAGE_SIZE - 1 and the max_segment_size to PAGE_SIZE, so shift those
settings into the drivers.  Note that in many cases the setting might
be bogus, but this keeps the status quo.

[mkp: fix myrs and myrb]

Signed-off-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen

scsi: target: replace fabric_ops.name with fabric_alias

2018-11-28T23:50:59+00:00

iscsi_target_mod is the only LIO fabric where fabric_ops.name differs from
the fabric_ops.fabric_name string.  fabric_ops.name is used when matching
target/$fabric ConfigFS create paths, so rename it .fabric_alias and
fallback to target/$fabric vs .fabric_name comparison if .fabric_alias
isn't initialised.  iscsi_target_mod is the only fabric module to set
.fabric_alias . All other fabric modules rely on .fabric_name matching and
can drop the duplicate string.

Signed-off-by: David Disseldorp 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen

scsi: target: drop unnecessary get_fabric_name() accessor from fabric_ops

2018-11-28T23:50:58+00:00

All fabrics return a const string. In all cases *except* iSCSI the
get_fabric_name() string matches fabric_ops.name.

Both fabric_ops.get_fabric_name() and fabric_ops.name are user-facing, with
the former being used for PR/ALUA state and the latter for ConfigFS
(config/target/$name), so we unfortunately need to keep both strings around
for now.  Replace the useless .get_fabric_name() accessor function with a
const string fabric_name member variable.

Signed-off-by: David Disseldorp 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen

scsi: target: loop, usb, vhost, xen: use target_remove_session

2018-08-02T19:29:31+00:00

This converts drivers that were only calling transport_deregister_session
to use target_remove_session. The calling of
transport_deregister_session_configfs via target_remove_session for these
types of drivers is ok, because they were not exporting info from fields
like sess_acl_list, sess->se_tpg and sess->fabric_sess_ptr from configfs
accessible functions, so they will see no difference.

Signed-off-by: Mike Christie 
Reviewed-by: Bart Van Assche 
Reviewed-by: Christoph Hellwig 
Cc: Felipe Balbi 
Cc: Sebastian Andrzej Siewior 
Cc: Andrzej Pietrasiewicz 
Cc: Michael S. Tsirkin 
Cc: Juergen Gross 
Signed-off-by: Martin K. Petersen

scsi: target: rename target_alloc_session

2018-08-02T19:29:31+00:00

Rename target_alloc_session to target_setup_session to avoid confusion with
the other transport session allocation function that only allocates the
session and because the target_alloc_session does so much more. It
allocates the session, sets up the nacl and registers the session.

The next patch will then add a remove function to match the setup in this
one, so it should make sense for all drivers, except iscsi, to just call
those 2 functions to setup and remove a session.

iscsi will continue to be the odd driver.

Signed-off-by: Mike Christie 
Reviewed-by: Bart Van Assche 
Reviewed-by: Christoph Hellwig 
Cc: Chris Boot 
Cc: Bryant G. Ly 
Cc: Michael Cyr 
Cc: 
Cc: Johannes Thumshirn 
Cc: Felipe Balbi 
Cc: Sebastian Andrzej Siewior 
Cc: Andrzej Pietrasiewicz 
Cc: Michael S. Tsirkin 
Cc: Juergen Gross 
Signed-off-by: Martin K. Petersen