Skip to content

Commit

Permalink
scst_copy_mgr: Fix scst_cm_desig_list list corruption
Browse files Browse the repository at this point in the history
This patch should fix the following bug:

list_del corruption. next->prev should be ffff955cb1ea2540, but was ffff955c54a32440
 ------------[ cut here ]------------
kernel BUG at lib/list_debug.c:54!
invalid opcode: 0000 [#1] SMP PTI
Workqueue: events vdev_inq_changed_fn [scst_vdisk]
RIP: 0010:__list_del_entry_valid.cold+0x1d/0x47
Call Trace:
 scst_cm_dev_unregister+0x66/0xd0 [scst]
 scst_cm_update_dev+0x41/0xc0 [scst]
 process_one_work+0x1ee/0x390
 worker_thread+0x53/0x3e0
 kthread+0x124/0x150
 ret_from_fork+0x1f/0x30

scst_cm_desig_list is a global list for all SCST devices. It must be
protected with scst_cm_mutex because it can be modified when
scst_cm_update_dev() is called by scst_cm_init_inq_finish() from
another thread.

Fixes: #99
  • Loading branch information
lnocturno committed Nov 15, 2022
1 parent 4894051 commit 1e5ab6c
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions scst/src/scst_copy_mgr.c
Original file line number Diff line number Diff line change
Expand Up @@ -2623,6 +2623,8 @@ static void scst_cm_dev_unregister(struct scst_device *dev, bool del_lun)

TRACE_DBG("dev %s, del_lun %d", dev->virt_name, del_lun);

mutex_lock(&scst_cm_mutex);

list_for_each_entry_safe(des, t, &scst_cm_desig_list, cm_desig_list_entry) {
if (des->desig_tgt_dev->dev == dev) {
TRACE_DBG("Deleting des %p", des);
Expand All @@ -2631,6 +2633,8 @@ static void scst_cm_dev_unregister(struct scst_device *dev, bool del_lun)
}
}

mutex_unlock(&scst_cm_mutex);

if (!del_lun)
goto out;

Expand Down

0 comments on commit 1e5ab6c

Please sign in to comment.