releases/4.16.8/scsi-target-fix-fortify_panic-kernel-exception.patch

   1 From f5957dade4f373b04fa1f5315a489f18cc2c4cb4 Mon Sep 17 00:00:00 2001
   2 From: Bryant G Ly <bryantly@linux.vnet.ibm.com>
   3 Date: Tue, 17 Apr 2018 10:33:21 -0500
   4 Subject: scsi: target: Fix fortify_panic kernel exception
   5
   6 From: Bryant G Ly <bryantly@linux.vnet.ibm.com>
   7
   8 commit f5957dade4f373b04fa1f5315a489f18cc2c4cb4 upstream.
   9
  10 memcmp() requires the two buffers passed as arguments to be at least
  11 'size' bytes long, otherwise a fortify_panic will trigger.
  12
  13 Use memchr_inv() instead of memcmp() to determine whether the received
  14 payload is zeroed or not.
  15
  16 The bug was found by running a block backstore via LIO.
  17
  18 [  496.212958] Call Trace:
  19 [  496.212960] [c0000007e58e3800] [c000000000cbbefc] fortify_panic+0x24/0x38 (unreliable)
  20 [  496.212965] [c0000007e58e3860] [d00000000f150c28] iblock_execute_write_same+0x3b8/0x3c0 [target_core_iblock]
  21 [  496.212976] [c0000007e58e3910] [d000000006c737d4] __target_execute_cmd+0x54/0x150 [target_core_mod]
  22 [  496.212982] [c0000007e58e3940] [d000000006d32ce4] ibmvscsis_write_pending+0x74/0xe0 [ibmvscsis]
  23 [  496.212991] [c0000007e58e39b0] [d000000006c74fc8] transport_generic_new_cmd+0x318/0x370 [target_core_mod]
  24 [  496.213001] [c0000007e58e3a30] [d000000006c75084] transport_handle_cdb_direct+0x64/0xd0 [target_core_mod]
  25 [  496.213011] [c0000007e58e3aa0] [d000000006c75298] target_submit_cmd_map_sgls+0x1a8/0x320 [target_core_mod]
  26 [  496.213021] [c0000007e58e3b30] [d000000006c75458] target_submit_cmd+0x48/0x60 [target_core_mod]
  27 [  496.213026] [c0000007e58e3bd0] [d000000006d34c20] ibmvscsis_scheduler+0x370/0x600 [ibmvscsis]
  28 [  496.213031] [c0000007e58e3c90] [c00000000013135c] process_one_work+0x1ec/0x580
  29 [  496.213035] [c0000007e58e3d20] [c000000000131798] worker_thread+0xa8/0x600
  30 [  496.213039] [c0000007e58e3dc0] [c00000000013a468] kthread+0x168/0x1b0
  31 [  496.213044] [c0000007e58e3e30] [c00000000000b528] ret_from_kernel_thread+0x5c/0xb4
  32
  33 [mkp: tweaked commit message]
  34
  35 Fixes: 2237498f0b5c ("target/iblock: Convert WRITE_SAME to blkdev_issue_zeroout")
  36 Signed-off-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
  37 Reviewed-by: Steven Royer <seroyer@linux.vnet.ibm.com>
  38 Tested-by: Taylor Jakobson <tjakobs@us.ibm.com>
  39 Cc: Christoph Hellwig <hch@lst.de>
  40 Cc: Nicholas Bellinger <nab@linux-iscsi.org>
  41 Cc: <stable@vger.kernel.org> # v4.13+
  42 Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
  43 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  44
  45 ---
  46  drivers/target/target_core_iblock.c |    8 ++++----
  47  1 file changed, 4 insertions(+), 4 deletions(-)
  48
  49 --- a/drivers/target/target_core_iblock.c
  50 +++ b/drivers/target/target_core_iblock.c
  51 @@ -427,8 +427,8 @@ iblock_execute_zero_out(struct block_dev
  52  {
  53         struct se_device *dev = cmd->se_dev;
  54         struct scatterlist *sg = &cmd->t_data_sg[0];
  55 -       unsigned char *buf, zero = 0x00, *p = &zero;
  56 -       int rc, ret;
  57 +       unsigned char *buf, *not_zero;
  58 +       int ret;
  59
  60         buf = kmap(sg_page(sg)) + sg->offset;
  61         if (!buf)
  62 @@ -437,10 +437,10 @@ iblock_execute_zero_out(struct block_dev
  63          * Fall back to block_execute_write_same() slow-path if
  64          * incoming WRITE_SAME payload does not contain zeros.
  65          */
  66 -       rc = memcmp(buf, p, cmd->data_length);
  67 +       not_zero = memchr_inv(buf, 0x00, cmd->data_length);
  68         kunmap(sg_page(sg));
  69
  70 -       if (rc)
  71 +       if (not_zero)
  72                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
  73
  74         ret = blkdev_issue_zeroout(bdev,