superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

scsi: target: tcm_loop: Fix NULL ptr dereference 

The TCM_LOOP LUN creation process calls device_register() to create the
device, which in turn invokes tcm_loop_driver_probe() registered with
the TCM_LOOP bus to create and register the scsi_host.  However, if the
scsi_host memory allocation fails or scsi_add_host() fails, the
device_register() process still returns success.  Subsequently, when the
user binds the LUN to a specific backend device, it accesses the NULL or
freed scsi_host.

Crash Call Trace:
  RIP: 0010:scsi_is_host_device+0x7/0x20
  scsi_alloc_target+0x32/0x2c0
  __scsi_add_device+0x41/0xf0
  scsi_add_device+0xd/0x30
  tcm_loop_port_link+0x25/0x50 [tcm_loop]
  target_fabric_port_link+0x9c/0xb0 [target_core_mod]
  ...

This issue is fixed by:

 1. Setting the tcm_loop_hba's scsi_host to NULL, if scsi_add_host()
    fails.

 2. Checking the tcm_loop_hba's scsi_host after device_register().

 3. Checking the tcm_loop_hba's scsi_host in tcm_loop_driver_remove().

Fixes: 3703b2c5d0 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Link: https://patch.msgid.link/20260424013923.25998-1-kanie@linux.alibaba.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
master
Guixin Liu 2026-04-24 09:39:23 +08:00 committed by Martin K. Petersen
parent b52a8d52c3
commit b71cb088b2
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/target/loopback/tcm_loop.c
View File

@ -393,6 +393,7 @@ static int tcm_loop_driver_probe(struct device *dev)
if (error) { if (error) {
pr_err("%s: scsi_add_host failed\n", __func__); pr_err("%s: scsi_add_host failed\n", __func__);
scsi_host_put(sh); scsi_host_put(sh);
tl_hba->sh = NULL;
return -ENODEV; return -ENODEV;
} }
return 0; return 0;
@ -406,8 +407,10 @@ static void tcm_loop_driver_remove(struct device *dev)
tl_hba = to_tcm_loop_hba(dev); tl_hba = to_tcm_loop_hba(dev);
sh = tl_hba->sh; sh = tl_hba->sh;
scsi_remove_host(sh); if (sh) {
scsi_host_put(sh); scsi_remove_host(sh);
scsi_host_put(sh);
}
} }
static void tcm_loop_release_adapter(struct device *dev) static void tcm_loop_release_adapter(struct device *dev)
@ -436,6 +439,11 @@ static int tcm_loop_setup_hba_bus(struct tcm_loop_hba *tl_hba, int tcm_loop_host
return -ENODEV; return -ENODEV;
} }
if (!tl_hba->sh) {
device_unregister(&tl_hba->dev);
return -ENODEV;
}
return 0; return 0;
} }