kernel/linux.git/drivers/target/loopback, branch v6.6.132

scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()

2025-12-01T10:41:42+00:00

commit e6965188f84a7883e6a0d3448e86b0cf29b24dfc upstream. If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it. Unable to allocate struct scsi_host BUG: kernel NULL pointer dereference, address: 0000000000000194 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024 RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop] ... Call Trace: configfs_read_iter+0x12d/0x1d0 [configfs] vfs_read+0x1b5/0x300 ksys_read+0x6f/0xf0 ... Cc: stable@vger.kernel.org Fixes: 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs") Signed-off-by: Hamza Mahfooz Reviewed-by: Chaitanya Kulkarni Reviewed-by: Allen Pais Link: https://patch.msgid.link/1762370746-6304-1-git-send-email-hamzamahfooz@linux.microsoft.com Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman

scsi: target: tcm_loop: Remove redundant driver match function

2023-03-25T00:44:14+00:00

If there is no driver match function, the driver core assumes that each candidate pair (driver, device) matches. See driver_match_device(). pseudo_lld_bus_match() always returns 1 and is therefore equivalent to not registering a match function. Remove it. Signed-off-by: Lizhe Link: https://lore.kernel.org/r/20230319043518.297490-1-sensor1010@163.com Signed-off-by: Martin K. Petersen

Merge patch series "Constify most SCSI host templates"

2023-03-25T00:13:03+00:00

Bart Van Assche says: It helps humans and the compiler if it is made explicit that SCSI host templates are not modified. Hence this patch series that constifies most SCSI host templates. Please consider this patch series for the next merge window. Link: https://lore.kernel.org/r/20230322195515.1267197-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen

scsi: target: tcm-loop: Declare SCSI host template const

2023-03-24T23:20:00+00:00

Make it explicit that the SCSI host template is not modified. Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20230322195515.1267197-79-bvanassche@acm.org Signed-off-by: Martin K. Petersen

scsi: target: loop: Remove default fabric ops callouts

2023-03-17T03:36:36+00:00

Remove callouts that are identical to the default implementations in TCM Core. Signed-off-by: Dmitry Bogdanov Link: https://lore.kernel.org/r/20230313181110.20566-5-d.bogdanov@yadro.com Signed-off-by: Martin K. Petersen

scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()

2022-11-17T17:46:16+00:00

If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(). The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need goto error label in this case. Fixes: 3703b2c5d041 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20221115015042.3652261-1-yangyingliang@huawei.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen

scsi: target: tcm_loop: Call scsi_done() directly

2021-10-17T01:31:43+00:00

Conditional statements are faster than indirect calls. Hence call scsi_done() directly. Link: https://lore.kernel.org/r/20211007204618.2196847-9-bvanassche@acm.org Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2021-09-02T22:09:46+00:00

Pull SCSI updates from James Bottomley: "This series consists of the usual driver updates (ufs, qla2xxx, target, smartpqi, lpfc, mpt3sas). The core change causing the most churn was replacing the command request field request with a macro, allowing us to offset map to it and remove the redundant field; the same was also done for the tag field. The most impactful change is the final removal of scsi_ioctl, which has been deprecated for over a decade" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (293 commits) scsi: ufs: Fix ufshcd_request_sense_async() for Samsung KLUFG8RHDA-B2D1 scsi: ufs: ufs-exynos: Fix static checker warning scsi: mpt3sas: Use the proper SCSI midlayer interfaces for PI scsi: lpfc: Use the proper SCSI midlayer interfaces for PI scsi: lpfc: Copyright updates for 14.0.0.1 patches scsi: lpfc: Update lpfc version to 14.0.0.1 scsi: lpfc: Add bsg support for retrieving adapter cmf data scsi: lpfc: Add cmf_info sysfs entry scsi: lpfc: Add debugfs support for cm framework buffers scsi: lpfc: Add support for maintaining the cm statistics buffer scsi: lpfc: Add rx monitoring statistics scsi: lpfc: Add support for the CM framework scsi: lpfc: Add cmfsync WQE support scsi: lpfc: Add support for cm enablement buffer scsi: lpfc: Add cm statistics buffer support scsi: lpfc: Add EDC ELS support scsi: lpfc: Expand FPIN and RDF receive logging scsi: lpfc: Add MIB feature enablement support scsi: lpfc: Add SET_HOST_DATA mbox cmd to pass date/time info to firmware scsi: fc: Add EDC ELS definition ...

scsi: tcm_loop: Use scsi_cmd_to_rq() instead of scsi_cmnd.request

2021-08-12T02:25:42+00:00

Prepare for removal of the request pointer by using scsi_cmd_to_rq() instead. This patch does not change any functionality. Link: https://lore.kernel.org/r/20210809230355.8186-51-bvanassche@acm.org Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen

scsi: target: Remove redundant assignment to variable ret

2021-07-27T04:06:42+00:00

The variable ret is being initialized with a value that is never read, the assignment is redundant and can be removed. Link: https://lore.kernel.org/r/20210721101519.42299-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen Addresses-Coverity: ("Unused value")