61fb248221
When tcmu queues a new command - no matter whether in command ring or in qfull_queue - a cmd_id from IDR udev->commands is assigned to the command. If userspace sends a wrong command completion containing the cmd_id of a command on the qfull_queue, tcmu_handle_completions() finds the command in the IDR and calls tcmu_handle_completion() for it. This might do some nasty things because commands in qfull_queue do not have a valid dbi list. To fix this bug, we no longer add queued commands to the idr. Instead the cmd_id is assign when a command is written to the command ring. Due to this change I had to adapt the source code at several places where up to now an idr_for_each had been done. [mkp: fix checkpatch warnings] Link: https://lore.kernel.org/r/20200518164833.12775-1-bstroesser@ts.fujitsu.com Acked-by: Mike Christie <mchristi@redhat.com> Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
||
---|---|---|
.. | ||
iscsi | ||
loopback | ||
sbp | ||
tcm_fc | ||
Kconfig | ||
Makefile | ||
target_core_alua.c | ||
target_core_alua.h | ||
target_core_configfs.c | ||
target_core_device.c | ||
target_core_fabric_configfs.c | ||
target_core_fabric_lib.c | ||
target_core_file.c | ||
target_core_file.h | ||
target_core_hba.c | ||
target_core_iblock.c | ||
target_core_iblock.h | ||
target_core_internal.h | ||
target_core_pr.c | ||
target_core_pr.h | ||
target_core_pscsi.c | ||
target_core_pscsi.h | ||
target_core_rd.c | ||
target_core_rd.h | ||
target_core_sbc.c | ||
target_core_spc.c | ||
target_core_stat.c | ||
target_core_tmr.c | ||
target_core_tpg.c | ||
target_core_transport.c | ||
target_core_ua.c | ||
target_core_ua.h | ||
target_core_user.c | ||
target_core_xcopy.c | ||
target_core_xcopy.h |