target: Add link_magic for fabric allow_link destination target_items

commit 0ff8754981261a80f4b77db2536dfea92c2d4539 upstream.

This patch adds [dev,lun]_link_magic value assignment + checks within generic
target_fabric_port_link() and target_fabric_mappedlun_link() code to ensure
destination config_item *target_item sent from configfs_symlink() ->
config_item_operations->allow_link() is the underlying se_device->dev_group
and se_lun->lun_group that we expect to symlink.

Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: CAI Qian <caiqian@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 9abef9f8eb760a88e7073802ceec77197421bf97..0943ff06d82e6379a532faf4581a9b26cec6d5e9 100644 (file)
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1624,6 +1624,7 @@ int core_dev_setup_virtual_lun0(void)
                ret = PTR_ERR(dev);
                goto out;
        }
+       dev->dev_link_magic = SE_DEV_LINK_MAGIC;
        se_dev->se_dev_ptr = dev;
        g_lun0_dev = dev;
 

diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index bca737bb813ddc1682fe6d0f9cd8ab27c618471b..a55f91aca7610c373d25face70d109d120a581b7 100644 (file)
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -71,6 +71,12 @@ static int target_fabric_mappedlun_link(
        struct se_portal_group *se_tpg;
        struct config_item *nacl_ci, *tpg_ci, *tpg_ci_s, *wwn_ci, *wwn_ci_s;
        int ret = 0, lun_access;
+
+       if (lun->lun_link_magic != SE_LUN_LINK_MAGIC) {
+               pr_err("Bad lun->lun_link_magic, not a valid lun_ci pointer:"
+                       " %p to struct lun: %p\n", lun_ci, lun);
+               return -EFAULT;
+       }
        /*
         * Ensure that the source port exists
         */
@@ -745,6 +751,12 @@ static int target_fabric_port_link(
        struct target_fabric_configfs *tf;
        int ret;
 
+       if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
+               pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
+                       " %p to struct se_device: %p\n", se_dev_ci, dev);
+               return -EFAULT;
+       }
+
        tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
        se_tpg = container_of(to_config_group(tpg_ci),
                                struct se_portal_group, tpg_group);

diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index a531fe282b1e4868b2286e3c7d842061636c9be8..4c346655249ff62bbd20127622f0f13e8ad1905d 100644 (file)
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -672,6 +672,7 @@ int core_tpg_register(
        for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
                lun = se_tpg->tpg_lun_list[i];
                lun->unpacked_lun = i;
+               lun->lun_link_magic = SE_LUN_LINK_MAGIC;
                lun->lun_status = TRANSPORT_LUN_STATUS_FREE;
                atomic_set(&lun->lun_acl_count, 0);
                init_completion(&lun->lun_shutdown_comp);

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index a392e05b5e66a6af201ac83378ac98acc1d1563f..13fe16c323d4d95e8d568acb4ff806385756094d 100644 (file)
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1071,6 +1071,7 @@ struct se_device *transport_add_device_to_core_hba(
        dev->se_hba             = hba;
        dev->se_sub_dev         = se_dev;
        dev->transport          = transport;
+       dev->dev_link_magic     = SE_DEV_LINK_MAGIC;
        INIT_LIST_HEAD(&dev->dev_list);
        INIT_LIST_HEAD(&dev->dev_sep_list);
        INIT_LIST_HEAD(&dev->dev_tmr_list);

diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 5be89373ceac659c92e671a463c80f146656c416..fca8bbee1d3d0e874bb027e02d81a794561f6564 100644 (file)
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -734,6 +734,8 @@ struct se_subsystem_dev {
 };
 
 struct se_device {
+#define SE_DEV_LINK_MAGIC                      0xfeeddeef
+       u32                     dev_link_magic;
        /* RELATIVE TARGET PORT IDENTIFER Counter */
        u16                     dev_rpti_counter;
        /* Used for SAM Task Attribute ordering */
@@ -820,6 +822,8 @@ struct se_port_stat_grps {
 };
 
 struct se_lun {
+#define SE_LUN_LINK_MAGIC                      0xffff7771
+       u32                     lun_link_magic;
        /* See transport_lun_status_table */
        enum transport_lun_status_table lun_status;
        u32                     lun_access;