PWN-Hunter/android_kernel_xiaomi_sdm845
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
29fe609d12
android_kernel_xiaomi_sdm845/drivers
History
Nicholas Bellinger 29fe609d12 [SCSI] target: Fix demo-mode MappedLUN shutdown UA/PR breakage 
This patch fixes a bug in core_update_device_list_for_node() where
individual demo-mode generated MappedLUN's UA + Persistent
Reservations metadata where being leaked, instead of falling through
and calling existing core_scsi3_ua_release_all() and
core_scsi3_free_pr_reg_from_nacl() at the end of
core_update_device_list_for_node().

This bug would manifest itself with the following OOPs w/ TPG
demo-mode endpoints (tfo->tpg_check_demo_mode()=1), and PROUT
REGISTER+RESERVE -> explict struct se_session logout -> struct
se_device shutdown:

[  697.021139] LIO_iblock used greatest stack depth: 2704 bytes left
[  702.235017] general protection fault: 0000 [#1] SMP
[  702.235074] last sysfs file: /sys/devices/virtual/net/lo/operstate
[  704.372695] CPU 0
[  704.372725] Modules linked in: crc32c target_core_stgt scsi_tgt target_core_pscsi target_core_file target_core_iblock target_core_mod configfs sr_mod cdrom sd_mod ata_piix mptspi mptscsih libata mptbase [last unloaded: iscsi_target_mod]
[  704.375442]
[  704.375563] Pid: 4964, comm: tcm_node Not tainted 2.6.37+ #1 440BX Desktop Reference Platform/VMware Virtual Platform
[  704.375912] RIP: 0010:[<ffffffffa00aaa16>]  [<ffffffffa00aaa16>] __core_scsi3_complete_pro_release+0x31/0x133 [target_core_mod]
[  704.376017] RSP: 0018:ffff88001e5ffcb8  EFLAGS: 00010296
[  704.376017] RAX: 6d32335b1b0a0d0a RBX: ffff88001d952cb0 RCX: 0000000000000015
[  704.376017] RDX: ffff88001b428000 RSI: ffff88001da5a4c0 RDI: ffff88001e5ffcd8
[  704.376017] RBP: ffff88001e5ffd28 R08: ffff88001e5ffcd8 R09: ffff88001d952080
[  704.377116] R10: ffff88001dfc5480 R11: ffff88001df8abb0 R12: ffff88001d952cb0
[  704.377319] R13: 0000000000000000 R14: ffff88001df8abb0 R15: ffff88001b428000
[  704.377521] FS:  00007f033d15c6e0(0000) GS:ffff88001fa00000(0000) knlGS:0000000000000000
[  704.377861] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  704.378043] CR2: 00007fff09281510 CR3: 000000001e5db000 CR4: 00000000000006f0
[  704.378110] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  704.378110] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  704.378110] Process tcm_node (pid: 4964, threadinfo ffff88001e5fe000, task ffff88001d99c260)
[  704.378110] Stack:
[  704.378110]  ffffea0000678980 ffff88001da5a4c0 ffffea0000678980 ffff88001f402b00
[  704.378110]  ffff88001e5ffd08 ffffffff810ea236 ffff88001e5ffd18 0000000000000282
[  704.379772]  ffff88001d952080 ffff88001d952cb0 ffff88001d952cb0 ffff88001dc79010
[  704.380082] Call Trace:
[  704.380220]  [<ffffffff810ea236>] ? __slab_free+0x89/0x11c
[  704.380403]  [<ffffffffa00ab781>] core_scsi3_free_all_registrations+0x3e/0x157 [target_core_mod]
[  704.380479]  [<ffffffffa00a752b>] se_release_device_for_hba+0xa6/0xd8 [target_core_mod]
[  704.380479]  [<ffffffffa00a7598>] se_free_virtual_device+0x3b/0x45 [target_core_mod]
[  704.383750]  [<ffffffffa00a3177>] target_core_drop_subdev+0x13a/0x18d [target_core_mod]
[  704.384068]  [<ffffffffa00960db>] client_drop_item+0x25/0x31 [configfs]
[  704.384263]  [<ffffffffa00967b5>] configfs_rmdir+0x1a1/0x223 [configfs]
[  704.384459]  [<ffffffff810fa8cd>] vfs_rmdir+0x7e/0xd3
[  704.384631]  [<ffffffff810fc3be>] do_rmdir+0xa3/0xf4
[  704.384895]  [<ffffffff810eed15>] ? filp_close+0x67/0x72
[  704.386485]  [<ffffffff810fc446>] sys_rmdir+0x11/0x13
[  704.387893]  [<ffffffff81002a92>] system_call_fastpath+0x16/0x1b
[  704.388083] Code: 4c 8d 45 b0 41 56 49 89 d7 41 55 41 89 cd 41 54 b9 15 00 00 00 53 48 89 fb 48 83 ec 48 4c 89 c7 48 89 75 98 48 8b 86 28 01 00 00 <48> 8b 80 90 01 00 00 48 89 45 a0 31 c0 f3 aa c7 45 ac 00 00 00
[  704.388763] RIP  [<ffffffffa00aaa16>] __core_scsi3_complete_pro_release+0x31/0x133 [target_core_mod]
[  704.389142]  RSP <ffff88001e5ffcb8>
[  704.389572] ---[ end trace 2a3614f3cd6261a5 ]---

Signed-off-by: Nicholas A. Bellinger <nab@linux-iscsi.org>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2011-02-12 11:37:29 -06:00
..
accessibility
acpi ACPI / PM: Call suspend_nvs_free() earlier during resume 2011-01-20 18:30:17 -08:00
amba
ata libata: set queue DMA alignment to sector size for ATAPI too 2011-01-28 03:16:20 -05:00
atm Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6 2011-01-24 13:17:06 -08:00
auxdisplay
base PM / Runtime: Don't enable interrupts while running in_interrupt 2011-01-25 20:50:07 +01:00
block nbd: remove module-level ioctl mutex 2011-02-11 16:12:20 -08:00
bluetooth Bluetooth: ath3k: reduce memory usage 2011-01-19 14:40:41 -02:00
cdrom cdrom: support devices that have check_events but not media_changed 2011-02-09 14:22:37 +01:00
char Merge branch 'for-james' of git://tpmdd.git.sourceforge.net/gitroot/tpmdd/tpmdd into for-linus 2011-02-11 17:34:47 +11:00
clk
clocksource drivers/clocksource/tcb_clksrc.c: fix init sequence 2011-01-26 10:50:04 +10:00
connector
cpufreq kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
cpuidle Merge branch 'cpuidle-perf-events' into idle-test 2011-01-12 18:06:19 -05:00
crypto Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2011-01-13 10:25:58 -08:00
dca dca: remove unneeded NULL check 2011-01-13 08:03:09 -08:00
dio
dma Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx 2011-01-17 10:54:41 -08:00
edac amd64_edac: Fix DIMMs per DCTs output 2011-02-10 14:41:49 +01:00
eisa
firewire Merge branches 'fixes' and 'fwnet' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 2011-01-21 13:34:39 -08:00
firmware kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
gpio drivers/gpio/pca953x.c: add a mutex to fix race condition 2011-02-11 16:12:20 -08:00
gpu Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 2011-02-04 10:02:22 -08:00
hid kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
hwmon hwmon: (emc1403) Fix I2C address range 2011-02-09 13:45:52 -08:00
i2c i2c: Encourage move to dev_pm_ops by warning on use of legacy methods 2011-01-14 22:03:50 +01:00
ide kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
idle fix a shutdown regression in intel_idle 2011-01-25 05:57:34 +10:00
ieee802154
infiniband Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband 2011-02-03 11:19:26 -08:00
input arm/ixp4xx: Rename FREQ macro to avoid collisions 2011-02-06 16:49:48 +01:00
isdn isdn: hysdn: Kill (partially buggy) CVS regision log reporting. 2011-02-09 13:56:53 -08:00
leds leds: leds-pwm: return proper error if pwm_request failed 2011-01-26 10:49:58 +10:00
lguest lguest: compile fixes 2011-01-20 21:37:29 +10:30
macintosh powerpc/macintosh: Fix wrong test in fan_{read,write}_reg() 2011-01-21 14:08:34 +11:00
mca
md FIX: md: process hangs at wait_barrier after 0->10 takeover 2011-02-08 11:49:02 +11:00
media Merge branch 'media_fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 2011-02-02 17:52:19 -08:00
memstick memstick: factor out transfer initiating functionality in mspro_block.c 2011-01-13 08:03:22 -08:00
message
mfd mfd: ab8500-core chip version cut 2.0 support 2011-01-14 12:38:18 +01:00
misc misc: Make AB8500_PWM driver depend on U8500 due to PWM breakage 2011-01-14 12:38:12 +01:00
mmc ARM: mmci: round down the bytes transferred on error 2011-01-31 10:53:37 +00:00
mtd Revert "UBI: use mtd->writebufsize to set minimal I/O unit size" 2011-01-29 18:27:13 +02:00
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2011-02-10 12:05:09 -08:00
nfc drivers/nfc/pn544.c: fix min_t warnings 2011-01-16 17:28:21 -08:00
nubus
of dt/flattree: Return virtual address from early_init_dt_alloc_memory_arch() 2011-01-15 22:01:58 -07:00
oprofile
parisc
parport parport: make lockdep happy with waitlist_lock 2011-01-26 10:49:59 +10:00
pci pci: use security_capable() when checking capablities during config space read 2011-02-11 17:58:11 +11:00
pcmcia kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
platform intel_scu_ipc: remove duplicated #include 2011-01-31 12:59:34 +10:00
pnp Merge branch 'pnp' into release 2011-01-12 04:59:44 -05:00
power Merge git://git.infradead.org/battery-2.6 2011-01-14 09:25:59 -08:00
pps pps: claim parallel port exclusively 2011-01-26 10:50:00 +10:00
ps3
rapidio rapidio: fix new kernel-doc warnings 2011-01-22 20:32:37 -08:00
regulator regulator: Support MAX8998/LP3974 DVS-GPIO 2011-01-14 12:38:16 +01:00
rtc drivers/rtc/rtc-proc.c: add module_put on error path in rtc_proc_open() 2011-02-11 16:12:20 -08:00
s390 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2011-02-04 13:20:01 -08:00
sbus sparc: explicitly cast negative phandle checks to s32 2011-01-03 20:02:06 -07:00
scsi [SCSI] scsi_debug: Fix 32-bit overflow in do_device_access causing memory corruption 2011-02-12 11:21:56 -06:00
sfi SFI: use ioremap_cache() instead of ioremap() 2011-01-11 23:27:25 -05:00
sh sh: update INTC to clear IRQ sense valid flag 2011-01-19 19:02:35 +09:00
sn
spi Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus 2011-01-18 14:28:48 -08:00
ssb Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2011-02-08 12:03:54 -08:00
staging Merge branch 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 2011-02-10 12:19:23 -08:00
target [SCSI] target: Fix demo-mode MappedLUN shutdown UA/PR breakage 2011-02-12 11:37:29 -06:00
tc
telephony Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2011-01-13 10:05:56 -08:00
thermal Merge branch 'misc' into release 2011-01-12 05:14:15 -05:00
tty virtio: console: Update Copyright 2011-02-09 08:19:55 +10:30
uio
usb USB: cdc-acm: Adding second ACM channel support for Nokia N8 2011-02-04 12:38:14 -08:00
uwb
vhost vhost: rcu annotation fixup 2011-02-01 16:48:46 +02:00
video console: rename acquire/release_console_sem() to console_lock/unlock() 2011-01-26 10:50:06 +10:00
virtio virtio: remove virtio-pci root device 2011-01-20 21:37:30 +10:30
vlynq
w1 drivers/w1/masters/omap_hdq.c: add missing clk_put 2011-02-11 16:12:20 -08:00
watchdog watchdog: Add MCF548x watchdog driver. 2011-01-12 13:51:35 +00:00
xen Merge branch 'xen/xenbus' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen 2011-01-20 16:37:28 -08:00
zorro
Kconfig [SCSI] target: Add LIO target core v4.0.0-rc6 2011-01-14 10:12:29 -06:00
Makefile Merge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 2011-01-20 16:39:23 -08:00