admin/libiscsi
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

iser: fix segmentation fault when task management pdu is received

Browse Source 
As iser_pdu->desc->data_dir is not initialised when sending a PDU.
The value remains what it was when it was used last time. Thus
a PDU could be considered to have data if it previously had and
might cause segmentation fault.

For example if a pdu is a reset task management task with no data
to transfer and the pdu is previously used as a read task. Thus
it would cause fault like below:

> struct scsi_iovector *iovector_in = &task->iovector_in;

0  0x00007ffff7bcb2d1 in iser_rcv_completion (rx_desc=0x555555b79e48, iser_conn=0x555555b573a0) at iser.c:1349
1  0x00007ffff7bcb53e in iser_handle_wc (wc=0x7fffffffdc00, iser_conn=0x555555b573a0) at iser.c:1426
2  0x00007ffff7bcb685 in cq_event_handler (iser_conn=0x555555b573a0) at iser.c:1468
3  0x00007ffff7bcb81b in cq_handle (iser_conn=0x555555b573a0) at iser.c:1516
4  0x00007ffff7bc8b28 in iscsi_iser_service (iscsi=0x555555b58710, revents=1) at iser.c:118
5  0x00007ffff7bc3862 in iscsi_service (iscsi=0x555555b58710, revents=1) at socket.c:1016
6  0x00007ffff7bc3f6c in event_loop (iscsi=0x555555b58710, state=0x7fffffffe000) at sync.c:71
7  0x00007ffff7bc4605 in iscsi_task_mgmt_sync (iscsi=0x555555b58710, lun=0, function=ISCSI_TM_LUN_RESET, ritt=4294967295, rcmdsn=0) at sync.c:281
8  0x00007ffff7bc46cf in iscsi_task_mgmt_lun_reset_sync (iscsi=0x555555b58710, lun=0) at sync.c:312
9  0x000055555555500d in iscsi_lun_reset_sync (iscsi=0x555555b58710) at iscsiclient_lun_reset.c:34
10 0x0000555555555680 in main (argc=7, argv=0x7fffffffe1c8) at iscsiclient_lun_reset.c:211

Signed-off-by: Hou Pu <houpu@bytedance.com>
This commit is contained in:
Hou Pu
2020-11-06 19:47:00 +08:00
parent ed90d56579
commit 03fa3f627c
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
include/iser-private.h
View File

@@ -72,7 +72,8 @@ enum desc_type {
enum data_dir{
DATA_WRITE = 0,
DATA_READ};
DATA_READ,
DATA_NONE};
#define SHIFT_4K 12
#define SIZE_4K (1ULL << SHIFT_4K)

3
lib/iser.c
View File

@@ -908,7 +908,8 @@ iser_send_command(struct iser_conn *iser_conn, struct iser_pdu *iser_pdu)
iscsi_set_error(iscsi, "error in prepare write cmd\n");
return -1;
}
}
} else
iser_pdu->desc->data_dir = DATA_NONE;
err = iser_post_send(iser_conn, tx_desc, true);
if (err)