/* * Mausezahn - A fast versatile traffic generator * Copyright (C) 2010 Herbert Haas * * This program is free software; you can redistribute it and/or modify it under * the terms of the GNU General Public License version 2 as published by the * Free Software Foundation. * * This program is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with * this program; if not, see http://www.gnu.org/licenses/gpl-2.0.html * */ #ifndef MZ_LINKED_LIST #define MZ_LINKED_LIST #define MAX_PACKET_SEQUENCE_LEN 20 // how many packets can be defined in a sequence at maximum // A packet sequence -- this is the list data (each list element corresponds to one sequence) struct pseq { struct mops *packet[MAX_PACKET_SEQUENCE_LEN]; // pointer to the packets struct timespec gap[MAX_PACKET_SEQUENCE_LEN]; // optional delay between different packets int count; // total number of current members (=packets) }; // --------------- Mausezahn Multipurpose Linked List: ------------------- #define MZ_LL_NAME_LEN 64 // one list element struct mz_ll { struct mz_ll *prev; struct mz_ll *next; struct mz_ll *head; // always points to head element int refcount; // head element: total number of list items! (Otherwise can be used as refcount.) char name[MZ_LL_NAME_LEN]; pthread_t sequence_thread; int state; // 0 = inactive, 1 = active int index; // monotonically increasing; int index_last; //head always stores the last value! void *data; // points to your data }; struct mz_ll *packet_sequences; struct mz_ll *cli_seq; // currently edited packet sequence used by CLI // prototypes struct mz_ll * mz_ll_create_new_element(struct mz_ll *list); int mz_ll_delete_element (struct mz_ll *cur); int mz_ll_delete_list(struct mz_ll *list); struct mz_ll * mz_ll_search_name (struct mz_ll *list, char *str); void _mz_ll_set_default (struct mz_ll *cur); int mz_ll_dump_all(struct mz_ll *list); int mops_tx_sequence (struct mz_ll *seq); // convenience functions using the above in a more intelligent way int mops_delete_sequence(char *name); struct mz_ll * mops_create_sequence (char *name); int mops_dump_sequence (char* str); int mops_add_packet_to_sequence (struct mz_ll *seq, struct mops *mp); int mops_add_delay_to_sequence (struct mz_ll *seq, struct timespec *t); int mops_delete_packet_from_pseq (struct mz_ll *seq, int index); int mops_delete_all_packets_from_pseq (struct mz_ll *seq); int stop_sequence (char *name); int stop_all_sequences (); #endif rm>
diff options
context:
space:
mode:
authorNicholas Bellinger <nab@linux-iscsi.org>2016-12-07 12:55:54 -0800
committerNicholas Bellinger <nab@linux-iscsi.org>2017-02-08 08:25:23 -0800
commit01d4d673558985d9a118e1e05026633c3e2ade9b (patch)
tree0aa259773374b5a919689c9db28d78274778b359
parentc54eeffbe9338fa982dc853d816fda9202a13b5a (diff)
target: Fix multi-session dynamic se_node_acl double free OOPs
This patch addresses a long-standing bug with multi-session (eg: iscsi-target + iser-target) se_node_acl dynamic free withini transport_deregister_session(). This bug is caused when a storage endpoint is configured with demo-mode (generate_node_acls = 1 + cache_dynamic_acls = 1) initiators, and initiator login creates a new dynamic node acl and attaches two sessions to it. After that, demo-mode for the storage instance is disabled via configfs (generate_node_acls = 0 + cache_dynamic_acls = 0) and the existing dynamic acl is never converted to an explicit ACL. The end result is dynamic acl resources are released twice when the sessions are shutdown in transport_deregister_session(). If the storage instance is not changed to disable demo-mode, or the dynamic acl is converted to an explict ACL, or there is only a single session associated with the dynamic ACL, the bug is not triggered. To address this big, move the release of dynamic se_node_acl memory into target_complete_nacl() so it's only freed once when se_node_acl->acl_kref reaches zero. (Drop unnecessary list_del_init usage - HCH) Reported-by: Rob Millner <rlm@daterainc.com> Tested-by: Rob Millner <rlm@daterainc.com> Cc: Rob Millner <rlm@daterainc.com> Cc: stable@vger.kernel.org # 4.1+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat
-rw-r--r--drivers/target/target_core_transport.c69
-rw-r--r--include/target/target_core_base.h1
2 files changed, 44 insertions, 26 deletions
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c