/*
 * netsniff-ng - the packet sniffing beast
 * Copyright 2011 Daniel Borkmann.
 * Subject to the GPL, version 2.
 */

#include <stdint.h>
#include <string.h>
#include <netinet/in.h>

#include "patricia.h"
#include "locking.h"
#include "trie.h"
#include "ipv4.h"
#include "ipv6.h"

static struct patricia_node *tree = NULL;

static struct rwlock tree_lock;

void trie_addr_lookup(char *buff, size_t len, int ipv4, int *fd,
		      struct sockaddr_storage *addr, size_t *alen)
{
	void *data;
	size_t dlen;
	struct ipv4hdr *hdr4 = (void *) buff;
	struct ipv6hdr *hdr6 = (void *) buff;

	data = ipv4 ? (void *) &hdr4->h_daddr : (void *) &hdr6->daddr;
	dlen = ipv4 ? sizeof(hdr4->h_daddr) : sizeof(hdr6->daddr);

	if (unlikely((ipv4 && ((struct ipv4hdr *) buff)->h_version != 4) ||
		     (!ipv4 && ((struct ipv6hdr *) buff)->version  != 6))) {
		memset(addr, 0, sizeof(*addr));
		(*alen) = 0;
		(*fd) = -1;
		return;
	}

	rwlock_rd_lock(&tree_lock);
	(*fd) = ptree_search_data_exact(data, dlen, addr, alen, tree);
	rwlock_unlock(&tree_lock);
}

int trie_addr_maybe_update(char *buff, size_t len, int ipv4, int fd,
			   struct sockaddr_storage *addr, size_t alen)
{
	int ret;
	void *data;
	size_t dlen;
	struct ipv4hdr *hdr4 = (void *) buff;
	struct ipv6hdr *hdr6 = (void *) buff;

	data = ipv4 ? (void *) &hdr4->h_saddr : (void *) &hdr6->saddr;
	dlen = ipv4 ? sizeof(hdr4->h_saddr) : sizeof(hdr6->saddr);

	if (unlikely((ipv4 && ((struct ipv4hdr *) buff)->h_version != 4) ||
		     (!ipv4 && ((struct ipv6hdr *) buff)->version  != 6)))
		return -1;

	rwlock_wr_lock(&tree_lock);
	ret = ptree_add_entry(data, dlen, fd, addr, alen, &tree);
	rwlock_unlock(&tree_lock);

	return ret;
}

void trie_addr_remove(int fd)
{
	int found = 1;
	struct patricia_node *n = NULL;

	rwlock_wr_lock(&tree_lock);

	while (found) {
		ptree_get_key(fd, tree, &n);
		if (n) {
			ptree_del_entry(n->key, n->klen, &tree);
			n = NULL;
		} else
			found = 0;
	}

	rwlock_unlock(&tree_lock);
}

void trie_addr_remove_addr(struct sockaddr_storage *addr, size_t alen)
{
	int found = 1;
	struct patricia_node *n = NULL;

	rwlock_wr_lock(&tree_lock);

	while (found) {
		ptree_get_key_addr(addr, alen, tree, &n);
		if (n) {
			ptree_del_entry(n->key, n->klen, &tree);
			n = NULL;
		} else
			found = 0;
	}

	rwlock_unlock(&tree_lock);
}

void trie_init(void)
{
	rwlock_init(&tree_lock);
}

void trie_cleanup(void)
{
	rwlock_wr_lock(&tree_lock);
	ptree_free(tree);
	rwlock_unlock(&tree_lock);
	rwlock_destroy(&tree_lock);
}
sg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='h' value='nds-private-remove'/><input type='hidden' name='id' value='dac37e15b7d511e026a9313c8c46794c144103cd'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Benjamin Block &lt;bblock@linux.vnet.ibm.com&gt;</td><td class='right'>2016-12-09 17:16:31 +0100</td></tr>
<tr><th>committer</th><td>Martin K. Petersen &lt;martin.petersen@oracle.com&gt;</td><td class='right'>2016-12-14 15:14:04 -0500</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/?h=nds-private-remove&amp;id=dac37e15b7d511e026a9313c8c46794c144103cd'>dac37e15b7d511e026a9313c8c46794c144103cd</a> (<a href='/cgit.cgi/linux/net-next.git/patch/?id=dac37e15b7d511e026a9313c8c46794c144103cd'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?h=nds-private-remove&amp;id=dac37e15b7d511e026a9313c8c46794c144103cd'>1aac535ca7ab7a8931b12155499798b5635d7882</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/?h=nds-private-remove&amp;id=165ae50e450bc7de6c741bf2c27ed0920a40a9af'>165ae50e450bc7de6c741bf2c27ed0920a40a9af</a> (<a href='/cgit.cgi/linux/net-next.git/diff/?h=nds-private-remove&amp;id=dac37e15b7d511e026a9313c8c46794c144103cd&amp;id2=165ae50e450bc7de6c741bf2c27ed0920a40a9af'>diff</a>)</td></tr></table>
<div class='commit-subject'>scsi: zfcp: fix use-after-"free" in FC ingress path after TMF</div><div class='commit-msg'>When SCSI EH invokes zFCP's callbacks for eh_device_reset_handler() and
eh_target_reset_handler(), it expects us to relent the ownership over
the given scsi_cmnd and all other scsi_cmnds within the same scope - LUN
or target - when returning with SUCCESS from the callback ('release'
them).  SCSI EH can then reuse those commands.

We did not follow this rule to release commands upon SUCCESS; and if
later a reply arrived for one of those supposed to be released commands,
we would still make use of the scsi_cmnd in our ingress tasklet. This
will at least result in undefined behavior or a kernel panic because of
a wrong kernel pointer dereference.

To fix this, we NULLify all pointers to scsi_cmnds (struct zfcp_fsf_req
*)-&gt;data in the matching scope if a TMF was successful. This is done
under the locks (struct zfcp_adapter *)-&gt;abort_lock and (struct
zfcp_reqlist *)-&gt;lock to prevent the requests from being removed from
the request-hashtable, and the ingress tasklet from making use of the
scsi_cmnd-pointer in zfcp_fsf_fcp_cmnd_handler().

For cases where a reply arrives during SCSI EH, but before we get a
chance to NULLify the pointer - but before we return from the callback
-, we assume that the code is protected from races via the CAS operation
in blk_complete_request() that is called in scsi_done().

The following stacktrace shows an example for a crash resulting from the
previous behavior:

Unable to handle kernel pointer dereference at virtual kernel address fffffee17a672000
Oops: 0038 [#1] SMP
CPU: 2 PID: 0 Comm: swapper/2 Not tainted
task: 00000003f7ff5be0 ti: 00000003f3d38000 task.ti: 00000003f3d38000
Krnl PSW : 0404d00180000000 00000000001156b0 (smp_vcpu_scheduled+0x18/0x40)
           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 EA:3
Krnl GPRS: 000000200000007e 0000000000000000 fffffee17a671fd8 0000000300000015
           ffffffff80000000 00000000005dfde8 07000003f7f80e00 000000004fa4e800
           000000036ce8d8f8 000000036ce8d9c0 00000003ece8fe00 ffffffff969c9e93
           00000003fffffffd 000000036ce8da10 00000000003bf134 00000003f3b07918
Krnl Code: 00000000001156a2: a7190000        lghi    %r1,0
           00000000001156a6: a7380015        lhi    %r3,21
          #00000000001156aa: e32050000008    ag    %r2,0(%r5)
          &gt;00000000001156b0: 482022b0        lh    %r2,688(%r2)
           00000000001156b4: ae123000        sigp    %r1,%r2,0(%r3)
           00000000001156b8: b2220020        ipm    %r2
           00000000001156bc: 8820001c        srl    %r2,28
           00000000001156c0: c02700000001    xilf    %r2,1
Call Trace:
([&lt;0000000000000000&gt;] 0x0)
 [&lt;000003ff807bdb8e&gt;] zfcp_fsf_fcp_cmnd_handler+0x3de/0x490 [zfcp]
 [&lt;000003ff807be30a&gt;] zfcp_fsf_req_complete+0x252/0x800 [zfcp]
 [&lt;000003ff807c0a48&gt;] zfcp_fsf_reqid_check+0xe8/0x190 [zfcp]
 [&lt;000003ff807c194e&gt;] zfcp_qdio_int_resp+0x66/0x188 [zfcp]
 [&lt;000003ff80440c64&gt;] qdio_kick_handler+0xdc/0x310 [qdio]
 [&lt;000003ff804463d0&gt;] __tiqdio_inbound_processing+0xf8/0xcd8 [qdio]
 [&lt;0000000000141fd4&gt;] tasklet_action+0x9c/0x170
 [&lt;0000000000141550&gt;] __do_softirq+0xe8/0x258
 [&lt;000000000010ce0a&gt;] do_softirq+0xba/0xc0
 [&lt;000000000014187c&gt;] irq_exit+0xc4/0xe8
 [&lt;000000000046b526&gt;] do_IRQ+0x146/0x1d8
 [&lt;00000000005d6a3c&gt;] io_return+0x0/0x8
 [&lt;00000000005d6422&gt;] vtime_stop_cpu+0x4a/0xa0
([&lt;0000000000000000&gt;] 0x0)
 [&lt;0000000000103d8a&gt;] arch_cpu_idle+0xa2/0xb0
 [&lt;0000000000197f94&gt;] cpu_startup_entry+0x13c/0x1f8
 [&lt;0000000000114782&gt;] smp_start_secondary+0xda/0xe8
 [&lt;00000000005d6efe&gt;] restart_int_handler+0x56/0x6c
 [&lt;0000000000000000&gt;] 0x0
Last Breaking-Event-Address:
 [&lt;00000000003bf12e&gt;] arch_spin_lock_wait+0x56/0xb0

Suggested-by: Steffen Maier &lt;maier@linux.vnet.ibm.com&gt;
Signed-off-by: Benjamin Block &lt;bblock@linux.vnet.ibm.com&gt;
Fixes: ea127f9754 ("[PATCH] s390 (7/7): zfcp host adapter.") (tglx/history.git)
Cc: &lt;stable@vger.kernel.org&gt; #2.6.32+
Signed-off-by: Steffen Maier &lt;maier@linux.vnet.ibm.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?h=nds-private-remove&amp;id=dac37e15b7d511e026a9313c8c46794c144103cd'>Diffstat</a></div><table summary='diffstat' class='diffstat'>