Commit 9e95fb80 authored by Sudhakar Panneerselvam's avatar Sudhakar Panneerselvam Committed by Martin K. Petersen
Browse files

scsi: target: Fix NULL pointer dereference 

NULL pointer dereference happens when the following conditions are met:

1) A SCSI command is received for a non-existing LU or cdb initialization
   fails in target_setup_cmd_from_cdb().

2) Tracing is enabled.

The following call sequences lead to NULL pointer dereference:

1) iscsit_setup_scsi_cmd
     transport_lookup_cmd_lun <-- lookup fails.
          or
     target_setup_cmd_from_cdb() <-- cdb initialization fails
   iscsit_process_scsi_cmd
     iscsit_sequence_cmd
       transport_send_check_condition_and_sense
         trace_target_cmd_complete <-- NULL dereference

2) target_submit_cmd_map_sgls
     transport_lookup_cmd_lun <-- lookup fails
          or
     target_setup_cmd_from_cdb() <-- cdb initialization fails
       transport_send_check_condition_and_sense
         trace_target_cmd_complete <-- NULL dereference

In the above sequence, cmd->t_task_cdb is uninitialized which when
referenced in trace_target_cmd_complete() causes NULL pointer dereference.

The fix is to use the helper, target_cmd_init_cdb() and call it after
transport_init_se_cmd() is called, so that cmd->t_task_cdb can be
initialized and hence can be referenced in trace_target_cmd_complete().

Link: https://lore.kernel.org/r/1591559913-8388-4-git-send-email-sudhakar.panneerselvam@oracle.com


Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Signed-off-by: default avatarSudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent a36840d8

drivers/target/iscsi/iscsi_target.c

+11 −7
Original line number Diff line number Diff line
@@ -1167,13 +1167,7 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, 


	target_get_sess_cmd(&cmd->se_cmd, true);



	cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd);

	if (cmd->sense_reason)

		goto attach_cmd;



	/* only used for printks or comparing with ->ref_task_tag */

	cmd->se_cmd.tag = (__force u32)cmd->init_task_tag;

	cmd->sense_reason = target_setup_cmd_from_cdb(&cmd->se_cmd, hdr->cdb);

	cmd->sense_reason = target_cmd_init_cdb(&cmd->se_cmd, hdr->cdb);

	if (cmd->sense_reason) {

		if (cmd->sense_reason == TCM_OUT_OF_RESOURCES) {

			return iscsit_add_reject_cmd(cmd,
@@ -1183,6 +1177,16 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, 
		goto attach_cmd;

	}



	cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd);

	if (cmd->sense_reason)

		goto attach_cmd;



	/* only used for printks or comparing with ->ref_task_tag */

	cmd->se_cmd.tag = (__force u32)cmd->init_task_tag;

	cmd->sense_reason = target_setup_cmd_from_cdb(&cmd->se_cmd, hdr->cdb);

	if (cmd->sense_reason)

		goto attach_cmd;



	if (iscsit_build_pdu_and_seq_lists(cmd, payload_length) < 0) {

		return iscsit_add_reject_cmd(cmd,

				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);

drivers/target/target_core_transport.c

+25 −6
Original line number Diff line number Diff line
@@ -1413,6 +1413,9 @@ transport_check_alloc_task_attr(struct se_cmd *cmd) 
sense_reason_t

target_cmd_init_cdb(struct se_cmd *cmd, unsigned char *cdb)

{

	sense_reason_t ret;



	cmd->t_task_cdb = &cmd->__t_task_cdb[0];

	/*

	 * Ensure that the received CDB is less than the max (252 + 8) bytes

	 * for VARIABLE_LENGTH_CMD
@@ -1421,7 +1424,8 @@ target_cmd_init_cdb(struct se_cmd *cmd, unsigned char *cdb) 
		pr_err("Received SCSI CDB with command_size: %d that"

			" exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n",

			scsi_command_size(cdb), SCSI_MAX_VARLEN_CDB_SIZE);

		return TCM_INVALID_CDB_FIELD;

		ret = TCM_INVALID_CDB_FIELD;

		goto err;

	}

	/*

	 * If the received CDB is larger than TCM_MAX_COMMAND_SIZE,
@@ -1436,10 +1440,10 @@ target_cmd_init_cdb(struct se_cmd *cmd, unsigned char *cdb) 
				" %u > sizeof(cmd->__t_task_cdb): %lu ops\n",

				scsi_command_size(cdb),

				(unsigned long)sizeof(cmd->__t_task_cdb));

			return TCM_OUT_OF_RESOURCES;

			ret = TCM_OUT_OF_RESOURCES;

			goto err;

		}

	}

	} else

		cmd->t_task_cdb = &cmd->__t_task_cdb[0];

	/*

	 * Copy the original CDB into cmd->

	 */
@@ -1447,6 +1451,15 @@ target_cmd_init_cdb(struct se_cmd *cmd, unsigned char *cdb) 


	trace_target_sequencer_start(cmd);

	return 0;



err:

	/*

	 * Copy the CDB here to allow trace_target_cmd_complete() to

	 * print the cdb to the trace buffers.

	 */

	memcpy(cmd->t_task_cdb, cdb, min(scsi_command_size(cdb),

					 (unsigned int)TCM_MAX_COMMAND_SIZE));

	return ret;

}

EXPORT_SYMBOL(target_cmd_init_cdb);
@@ -1456,8 +1469,6 @@ target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb) 
	struct se_device *dev = cmd->se_dev;

	sense_reason_t ret;



	target_cmd_init_cdb(cmd, cdb);



	ret = dev->transport->parse_cdb(cmd);

	if (ret == TCM_UNSUPPORTED_SCSI_OPCODE)

		pr_warn_ratelimited("%s/%s: Unsupported SCSI Opcode 0x%02x, sending CHECK_CONDITION.\n",
@@ -1621,6 +1632,14 @@ int target_submit_cmd_map_sgls(struct se_cmd *se_cmd, struct se_session *se_sess 
	 */

	if (flags & TARGET_SCF_BIDI_OP)

		se_cmd->se_cmd_flags |= SCF_BIDI;



	rc = target_cmd_init_cdb(se_cmd, cdb);

	if (rc) {

		transport_send_check_condition_and_sense(se_cmd, rc, 0);

		target_put_sess_cmd(se_cmd);

		return 0;

	}



	/*

	 * Locate se_lun pointer and attach it to struct se_cmd

	 */

drivers/target/target_core_xcopy.c

+3 −0
Original line number Diff line number Diff line
@@ -526,6 +526,9 @@ static int target_xcopy_setup_pt_cmd( 
	}

	cmd->se_cmd_flags |= SCF_SE_LUN_CMD;



	if (target_cmd_init_cdb(cmd, cdb))

		return -EINVAL;



	cmd->tag = 0;

	if (target_setup_cmd_from_cdb(cmd, cdb))

		return -EINVAL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE