Received: by 2002:a17:90a:9103:0:0:0:0 with SMTP id k3csp11793190pjo; Thu, 2 Jan 2020 14:22:39 -0800 (PST) X-Google-Smtp-Source: APXvYqwba0woG4DjF0pT89J5Y16UYnc1U7D22L2Mwtqfiu3QnJhWK4qxrplryE8jAnSS8NVj0hoS X-Received: by 2002:a9d:7f11:: with SMTP id j17mr98127684otq.281.1578003759365; Thu, 02 Jan 2020 14:22:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1578003759; cv=none; d=google.com; s=arc-20160816; b=AlrwzY8oZI/eyXZjq8VB61gdMopnZyfj2+yn/peHVT9RHbPDArWhXSVYpC95qKpQ+J WhNN9L7Rbl88+7q1gUCceua6wZWpupy7JbZ19AZe6lx7vxjFykG7nILrk+Jm8tFDGNkY qZJHxjamOn2FeOL6pXRZRglJjMCDV5cJ2T7u+cO7GZxzwyAPvz34ezLPHRbCs8xAy8Wb hvSr8DjJIpLhVqkW8KkUut+ZwMTUboYlzUiEAICV+fh7LtqEeR7DdIUs+5gqQjG53wD/ WlNg7k437BMkSIATWOiOwNtWz/AbRjE8BmOzqORGpZrVICcjIqqOJh+yhTZlreRX/poW Y2fg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=+4LNzJ6oKwzHwogVwNTLS/R6uH9Y+KkpIX1huDlyf0I=; b=JugygTYsIK1ng5FRZR1n7i0v9nm5/jJFdU3P6/8HDaZdbpaSzNAj9XrcC8Kr9qBhbM Fq1EFfDE9j0AX8xRmaudRGnMyMqgRMgmHvYFhV26ger354RuMwO4tEiRB0sS9k0dWIPN buMNH0jAoEw1KcNiO5mTcAPUsts7baxEvtPlepSviSV2F7WyRV2SGV3RSbFwbLNp1Mx6 hZ2eEHHy4vKGazE/lv1wyj7vq6/SjX+S8EpHmGVT8/sB0xpCj5Ouki60lAv9WSp+Wgha o41Lx1q/exyg7IPf76ONjosjABxtj1YdPSeog03485CiNiSqfdi3db4lPV4SJXSj+7US n5Sw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=D6jFCDLg; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l16si25780191otj.59.2020.01.02.14.22.27; Thu, 02 Jan 2020 14:22:39 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=D6jFCDLg; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728250AbgABWUt (ORCPT + 99 others); Thu, 2 Jan 2020 17:20:49 -0500 Received: from mail.kernel.org ([198.145.29.99]:38876 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728228AbgABWUr (ORCPT ); Thu, 2 Jan 2020 17:20:47 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5062020866; Thu, 2 Jan 2020 22:20:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578003646; bh=jOOzvq5ORcSHs/dfITV3t/TYLOXAFsVSdo+42xIWT94=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D6jFCDLghlJw2LrFpkzPtUTVekx4ZeUlok/gJ+dgjf3+uSq5cV3QLVPjblRBI8jrI CtU8a/Naqhb68mT9DWbT+wibeCJeDZ/JOPZItdovJMEmoG9UCxZbWx2xRso5MsxEJT hf8uHlWRPFpCWx64Xv44Bm7rnQTSgVtWfEn5UENc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Anatol Pomazau , Frank Mayhar , Bharath Ravi , Khazhimsel Kumykov , Gabriel Krisman Bertazi , Lee Duncan , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.19 056/114] scsi: iscsi: Dont send data to unbound connection Date: Thu, 2 Jan 2020 23:07:08 +0100 Message-Id: <20200102220034.705851515@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200102220029.183913184@linuxfoundation.org> References: <20200102220029.183913184@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Anatol Pomazau [ Upstream commit 238191d65d7217982d69e21c1d623616da34b281 ] If a faulty initiator fails to bind the socket to the iSCSI connection before emitting a command, for instance, a subsequent send_pdu, it will crash the kernel due to a null pointer dereference in sock_sendmsg(), as shown in the log below. This patch makes sure the bind succeeded before trying to use the socket. BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.4.0-rc2.iscsi+ #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 24.158246] Workqueue: iscsi_q_0 iscsi_xmitworker [ 24.158883] RIP: 0010:apparmor_socket_sendmsg+0x5/0x20 [...] [ 24.161739] RSP: 0018:ffffab6440043ca0 EFLAGS: 00010282 [ 24.162400] RAX: ffffffff891c1c00 RBX: ffffffff89d53968 RCX: 0000000000000001 [ 24.163253] RDX: 0000000000000030 RSI: ffffab6440043d00 RDI: 0000000000000000 [ 24.164104] RBP: 0000000000000030 R08: 0000000000000030 R09: 0000000000000030 [ 24.165166] R10: ffffffff893e66a0 R11: 0000000000000018 R12: ffffab6440043d00 [ 24.166038] R13: 0000000000000000 R14: 0000000000000000 R15: ffff9d5575a62e90 [ 24.166919] FS: 0000000000000000(0000) GS:ffff9d557db80000(0000) knlGS:0000000000000000 [ 24.167890] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.168587] CR2: 0000000000000018 CR3: 000000007a838000 CR4: 00000000000006e0 [ 24.169451] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.170320] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.171214] Call Trace: [ 24.171537] security_socket_sendmsg+0x3a/0x50 [ 24.172079] sock_sendmsg+0x16/0x60 [ 24.172506] iscsi_sw_tcp_xmit_segment+0x77/0x120 [ 24.173076] iscsi_sw_tcp_pdu_xmit+0x58/0x170 [ 24.173604] ? iscsi_dbg_trace+0x63/0x80 [ 24.174087] iscsi_tcp_task_xmit+0x101/0x280 [ 24.174666] iscsi_xmit_task+0x83/0x110 [ 24.175206] iscsi_xmitworker+0x57/0x380 [ 24.175757] ? __schedule+0x2a2/0x700 [ 24.176273] process_one_work+0x1b5/0x360 [ 24.176837] worker_thread+0x50/0x3c0 [ 24.177353] kthread+0xf9/0x130 [ 24.177799] ? process_one_work+0x360/0x360 [ 24.178401] ? kthread_park+0x90/0x90 [ 24.178915] ret_from_fork+0x35/0x40 [ 24.179421] Modules linked in: [ 24.179856] CR2: 0000000000000018 [ 24.180327] ---[ end trace b4b7674b6df5f480 ]--- Signed-off-by: Anatol Pomazau Co-developed-by: Frank Mayhar Signed-off-by: Frank Mayhar Co-developed-by: Bharath Ravi Signed-off-by: Bharath Ravi Co-developed-by: Khazhimsel Kumykov Signed-off-by: Khazhimsel Kumykov Co-developed-by: Gabriel Krisman Bertazi Signed-off-by: Gabriel Krisman Bertazi Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/iscsi_tcp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c index 23354f206533..55181d28291e 100644 --- a/drivers/scsi/iscsi_tcp.c +++ b/drivers/scsi/iscsi_tcp.c @@ -374,8 +374,16 @@ static int iscsi_sw_tcp_pdu_xmit(struct iscsi_task *task) { struct iscsi_conn *conn = task->conn; unsigned int noreclaim_flag; + struct iscsi_tcp_conn *tcp_conn = conn->dd_data; + struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; int rc = 0; + if (!tcp_sw_conn->sock) { + iscsi_conn_printk(KERN_ERR, conn, + "Transport not bound to socket!\n"); + return -EINVAL; + } + noreclaim_flag = memalloc_noreclaim_save(); while (iscsi_sw_tcp_xmit_qlen(conn)) { -- 2.20.1