mirror of
https://github.com/torvalds/linux.git
synced 2024-11-27 14:41:39 +00:00
4c363c81f6
We normally clear the endpoint then unmap LUNs so the devices are fully shutdown when the LUN is unmapped, but it's legal to unmap before clearing. If the user does that while TMFs are running then we can end up crashing. vhost_scsi_port_unlink assumes that the LUN's tmf struct will always be on the tmf_queue list. However, if a TMF is running then it will have been removed while it's executing. If we do a LUN unmap at this time, then we assume the entry is on the list and just start accessing it and free it. This fixes the bug by just allocating the vhost_scsi_tmf struct when it's needed like is done with the se_tmr struct that's needed when we submit the TMF. In this path perf is not an issue and we can use GFP_KERNEL since it won't swing directly back on us, so we don't need to preallocate the struct. Signed-off-by: Mike Christie <michael.christie@oracle.com> Message-Id: <20230321020624.13323-3-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
||
|---|---|---|
| .. | ||
| iotlb.c | ||
| Kconfig | ||
| Makefile | ||
| net.c | ||
| scsi.c | ||
| test.c | ||
| test.h | ||
| vdpa.c | ||
| vhost.c | ||
| vhost.h | ||
| vringh.c | ||
| vsock.c | ||