linux-stable.git/drivers/target, branch linux-6.16.y

scsi: target: target_core_configfs: Add length check to avoid buffer overflow

2025-10-06T09:18:47+00:00

commit 27e06650a5eafe832a90fd2604f0c5e920857fae upstream.

A buffer overflow arises from the usage of snprintf to write into the
buffer "buf" in target_lu_gp_members_show function located in
/drivers/target/target_core_configfs.c. This buffer is allocated with
size LU_GROUP_NAME_BUF (256 bytes).

snprintf(...) formats multiple strings into buf with the HBA name
(hba->hba_group.cg_item), a slash character, a devicename (dev->
dev_group.cg_item) and a newline character, the total formatted string
length may exceed the buffer size of 256 bytes.

Since snprintf() returns the total number of bytes that would have been
written (the length of %s/%sn ), this value may exceed the buffer length
(256 bytes) passed to memcpy(), this will ultimately cause function
memcpy reporting a buffer overflow error.

An additional check of the return value of snprintf() can avoid this
buffer overflow.

Reported-by: Wang Haoran 
Reported-by: ziiiro 
Signed-off-by: Wang Haoran 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman

scsi: target: core: Generate correct identifiers for PR OUT transport IDs

2025-08-20T16:41:30+00:00

[ Upstream commit 6e0f6aa44b68335df404a2df955055f416b5f2aa ]

Fix target_parse_pr_out_transport_id() to return a string representing
the transport ID in a human-readable format (e.g., naa.xxxxxxxx...)  for
various SCSI protocol types (SAS, FCP, SRP, SBP).

Previously, the function returned a pointer to the raw binary buffer,
which was incorrectly compared against human-readable strings, causing
comparisons to fail.  Now, the function writes a properly formatted
string into a buffer provided by the caller.  The output format depends
on the transport protocol:

* SAS: 64-bit identifier, "naa." prefix.
* FCP: 64-bit identifier, colon separated values.
* SBP: 64-bit identifier, no prefix.
* SRP: 128-bit identifier, "0x" prefix.
* iSCSI: IQN string.

Signed-off-by: Maurizio Lombardi 
Link: https://lore.kernel.org/r/20250714133738.11054-1-mlombard@redhat.com
Reviewed-by: Dmitry Bogdanov 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()

2025-06-16T18:35:57+00:00

The function core_scsi3_decode_spec_i_port(), in its error code path,
unconditionally calls core_scsi3_lunacl_undepend_item() passing the
dest_se_deve pointer, which may be NULL.

This can lead to a NULL pointer dereference if dest_se_deve remains
unset.

SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg
Unable to handle kernel paging request at virtual address dfff800000000012
Call trace:
  core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)
  core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]
  core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]
  target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]

Fix this by adding a NULL check before calling
core_scsi3_lunacl_undepend_item()

Signed-off-by: Maurizio Lombardi 
Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com
Reviewed-by: Mike Christie 
Reviewed-by: John Meneghini 
Signed-off-by: Martin K. Petersen

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37+00:00

Move this API to the canonical timer_*() namespace.

[ tglx: Redone against pre rc1 ]

Signed-off-by: Ingo Molnar 
Signed-off-by: Thomas Gleixner 
Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2025-05-30T05:17:52+00:00

Pull SCSI updates from James Bottomley:
 "Updates to the usual drivers (smartpqi, ufs, lpfc, scsi_debug, target,
  hisi_sas) with the only substantive core change being the removal of
  the stream_status member from the scsi_stream_status_header (to get
  rid of flex array members)"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (77 commits)
  scsi: target: core: Constify struct target_opcode_descriptor
  scsi: target: core: Constify enabled() in struct target_opcode_descriptor
  scsi: hisi_sas: Fix warning detected by sparse
  scsi: mpt3sas: Fix _ctl_get_mpt_mctp_passthru_adapter() to return IOC pointer
  scsi: sg: Remove unnecessary NULL check before unregister_sysctl_table()
  scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
  scsi: ufs: qcom: dt-bindings: Document the SM8750 UFS Controller
  scsi: mvsas: Fix typos in SAS/SATA VSP register comments
  scsi: fnic: Replace memset() with eth_zero_addr()
  scsi: ufs: core: Support updating device command timeout
  scsi: ufs: core: Change hwq_id type and value
  scsi: ufs: core: Increase the UIC command timeout further
  scsi: zfcp: Simplify workqueue allocation
  scsi: ufs: core: Print error value as hex format in ufshcd_err_handler()
  scsi: sd: Remove the stream_status member from scsi_stream_status_header
  scsi: docs: Clean up some style in scsi_mid_low_api
  scsi: core: Remove unused scsi_dev_info_list_del_keyed()
  scsi: isci: Remove unused sci_remote_device_reset()
  scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH
  scsi: smartpqi: Delete a stray tab in pqi_is_parity_write_stream()
  ...

net: core: Convert inet_addr_is_any() to sockaddr_storage

2025-05-27T06:25:42+00:00

All the callers of inet_addr_is_any() have a sockaddr_storage-backed
sockaddr. Avoid casts and switch prototype to the actual object being
used.

Reviewed-by: Kuniyuki Iwashima 
Reviewed-by: Martin K. Petersen  # SCSI
Signed-off-by: Kees Cook 
Link: https://patch.msgid.link/20250521204619.2301870-1-kees@kernel.org
Signed-off-by: Paolo Abeni

scsi: target: core: Constify struct target_opcode_descriptor

2025-05-21T02:11:03+00:00

Instances of 'struct target_opcode_descriptor' are not modified in this
driver.

Constifying this structure moves some data to a read-only section, so
increase overall security, especially when the structure holds some
function pointers.

On a x86_64, with allmodconfig:
Before:
======
   text	   data	    bss	    dec	    hex	filename
  53602	  19750	      0	  73352	  11e88	drivers/target/target_core_spc.o

After:
=====
   text	   data	    bss	    dec	    hex	filename
  58594	  14758	      0	  73352	  11e88	drivers/target/target_core_spc.o

Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/889ee46e75db33e8ab997a627a1d3d651ad648db.1747592774.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Martin K. Petersen

scsi: target: core: Constify enabled() in struct target_opcode_descriptor

2025-05-21T02:11:03+00:00

Constify the first argument of the enabled() function in struct
target_opcode_descriptor.

This is the first step in order to constify struct
target_opcode_descriptor.

Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/4290cf1dbe100c1b1edf2ede5e5aef19b04ee7f2.1747592774.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Martin K. Petersen

Merge patch series "target: Remove atomics from main IO path"

2025-04-29T01:48:37+00:00

Mike Christie  says:

The following patches made over Linus's tree remove the atomic use from
the main IO path. There was a handful of atomic_longs used just used
for stats and a couple atomics used for handling ordered commands. These
patches move the stats to per cpu, and moves the ordered tracking to a
per cpu counter.

With the patches 8K IOPS increases by up to 33% when running fio
with numjobs >= 4 and using the vhost-scsi target with virtio-scsi
and virtio num_queues >= 4 (jobs and queues match, and virtqueue_size
and cmd_per_lun are increased to match the total iodepth of all
jobs).

Link: https://lore.kernel.org/r/20250424032741.16216-1-michael.christie@oracle.com
Signed-off-by: Martin K. Petersen

scsi: target: Move delayed/ordered tracking to per CPU

2025-04-29T01:47:55+00:00

The atomic use from the delayed/ordered tracking is causing perf issues
when using higher perf backend devices and multiple queues.  This moves
the values to a per CPU counter. Combined with the per CPU stats patch,
this improves IOPS by up to 33% for 8K IOS when using 4 or more queues
from the initiator.

Signed-off-by: Mike Christie 
Link: https://lore.kernel.org/r/20250424032741.16216-3-michael.christie@oracle.com
Reviewed-by: Hannes Reinecke 
Signed-off-by: Martin K. Petersen