{"push_id":2871523294,"size":6,"distinct_size":6,"ref":"refs/heads/master","head":"96eddb810b146e4d364e35f38dc11d16680c66eb","before":"5e335542de83558e46d28de1008a1c37d5d6679a","commits":[{"sha":"7915919bb94e12460c58e27c708472e6f85f6699","author":{"name":"Vincent Pelletier","email":"79ed65387ffcd88b36f0a80b55bba4063084e90e@gmail.com"},"message":"scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values fails\n\nFixes a use-after-free reported by KASAN when later\niscsi_target_login_sess_out gets called and it tries to access\nconn->sess->se_sess:\n\nDisabling lock debugging due to kernel taint\niSCSI Login timeout on Network Portal [::]:3260\niSCSI Login negotiation failed.\n==================================================================\nBUG: KASAN: use-after-free in\niscsi_target_login_sess_out.cold.12+0x58/0xff [iscsi_target_mod]\nRead of size 8 at addr ffff880109d070c8 by task iscsi_np/980\n\nCPU: 1 PID: 980 Comm: iscsi_np Tainted: G           O\n4.17.8kasan.sess.connops+ #4\nHardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB,\nBIOS 5.6.5 05/19/2014\nCall Trace:\n dump_stack+0x71/0xac\n print_address_description+0x65/0x22e\n ? iscsi_target_login_sess_out.cold.12+0x58/0xff [iscsi_target_mod]\n kasan_report.cold.6+0x241/0x2fd\n iscsi_target_login_sess_out.cold.12+0x58/0xff [iscsi_target_mod]\n iscsi_target_login_thread+0x1086/0x1710 [iscsi_target_mod]\n ? __sched_text_start+0x8/0x8\n ? iscsi_target_login_sess_out+0x250/0x250 [iscsi_target_mod]\n ? __kthread_parkme+0xcc/0x100\n ? parse_args.cold.14+0xd3/0xd3\n ? iscsi_target_login_sess_out+0x250/0x250 [iscsi_target_mod]\n kthread+0x1a0/0x1c0\n ? kthread_bind+0x30/0x30\n ret_from_fork+0x35/0x40\n\nAllocated by task 980:\n kasan_kmalloc+0xbf/0xe0\n kmem_cache_alloc_trace+0x112/0x210\n iscsi_target_login_thread+0x816/0x1710 [iscsi_target_mod]\n kthread+0x1a0/0x1c0\n ret_from_fork+0x35/0x40\n\nFreed by task 980:\n __kasan_slab_free+0x125/0x170\n kfree+0x90/0x1d0\n iscsi_target_login_thread+0x1577/0x1710 [iscsi_target_mod]\n kthread+0x1a0/0x1c0\n ret_from_fork+0x35/0x40\n\nThe buggy address belongs to the object at ffff880109d06f00\n which belongs to the cache kmalloc-512 of size 512\nThe buggy address is located 456 bytes inside of\n 512-byte region [ffff880109d06f00, ffff880109d07100)\nThe buggy address belongs to the page:\npage:ffffea0004274180 count:1 mapcount:0 mapping:0000000000000000\nindex:0x0 compound_mapcount: 0\nflags: 0x17fffc000008100(slab|head)\nraw: 017fffc000008100 0000000000000000 0000000000000000 00000001000c000c\nraw: dead000000000100 dead000000000200 ffff88011b002e00 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff880109d06f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff880109d07000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n>ffff880109d07080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                              ^\n ffff880109d07100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff880109d07180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n==================================================================\n\nSigned-off-by: Vincent Pelletier <plr.vincent@gmail.com>\n[rebased against idr/ida changes and to handle ret review comments from Matthew]\nSigned-off-by: Mike Christie <mchristi@redhat.com>\nCc: Matthew Wilcox <willy@infradead.org>\nReviewed-by: Matthew Wilcox <willy@infradead.org>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/7915919bb94e12460c58e27c708472e6f85f6699"},{"sha":"05a86e78ea9823ec25b3515db078dd8a76fc263c","author":{"name":"Mike Christie","email":"39daeb1549a929782e38aa87c4e3da7f3844b09a@redhat.com"},"message":"scsi: iscsi: target: Fix conn_ops double free\n\nIf iscsi_login_init_conn fails it can free conn_ops.\n__iscsi_target_login_thread will then call iscsi_target_login_sess_out\nwhich will also free it.\n\nThis fixes the problem by organizing conn allocation/setup into parts that\nare needed through the life of the conn and parts that are only needed for\nthe login. The free functions then release what was allocated in the alloc\nfunctions.\n\nWith this patch we have:\n\niscsit_alloc_conn/iscsit_free_conn - allocs/frees the conn we need for the\nentire life of the conn.\n\niscsi_login_init_conn/iscsi_target_nego_release - allocs/frees the parts\nof the conn that are only needed during login.\n\nSigned-off-by: Mike Christie <mchristi@redhat.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/05a86e78ea9823ec25b3515db078dd8a76fc263c"},{"sha":"c77a2fa3ff8f73d1a485e67e6f81c64823739d59","author":{"name":"Nilesh Javali","email":"c64d1aff7b4dc8d28adf2668c7f7d76566dc315a@cavium.com"},"message":"scsi: qedi: Add the CRC size within iSCSI NVM image\n\nThe QED driver commit, 1ac4329a1cff (\"qed: Add configuration information\nto register dump and debug data\"), removes the CRC length validation\ncausing nvm_get_image failure while loading qedi driver:\n\n[qed_mcp_get_nvm_image:2700(host_10-0)]Image [0] is too big - 00006008 bytes\nwhere only 00006004 are available\n[qedi_get_boot_info:2253]:10: Could not get NVM image. ret = -12\n\nHence add and adjust the CRC size to iSCSI NVM image to read boot info at\nqedi load time.\n\nSigned-off-by: Nilesh Javali <nilesh.javali@cavium.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/c77a2fa3ff8f73d1a485e67e6f81c64823739d59"},{"sha":"e866d3e84eb7c9588afb77604d417e8cc49fe216","author":{"name":"Guenter Roeck","email":"ba324ca7b1c77fc20bb970d5aff6eea9377918a5@roeck-us.net"},"message":"riscv: Do not overwrite initrd_start and initrd_end\n\nsetup_initrd() overwrites initrd_start and initrd_end if __initramfs_size\nis larger than 0, which is always true even if there is no embedded\ninitramfs. This prevents booting qemu with \"-initrd\" parameter.\nOverwriting initrd_start and initrd_end is not necessary since\n__initramfs_start and __initramfs_size are used directly in\npopulate_rootfs() to load the built-in initramfs, so just drop\nthat code.\n\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Palmer Dabbelt <palmer@sifive.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/e866d3e84eb7c9588afb77604d417e8cc49fe216"},{"sha":"aeb5427218a72ead8be673c0fba21839d2a3bb70","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Three fixes, all in drivers (qedi and iscsi target) so no wider impact\n  even if the code changes are a bit extensive\"\n\n* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n  scsi: qedi: Add the CRC size within iSCSI NVM image\n  scsi: iscsi: target: Fix conn_ops double free\n  scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values fails","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/aeb5427218a72ead8be673c0fba21839d2a3bb70"},{"sha":"96eddb810b146e4d364e35f38dc11d16680c66eb","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Merge tag 'riscv-for-linus-4.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux\n\nPull RISC-V fix from Palmer Dabbelt:\n \"This contains what I hope to be the last RISC-V patch for 4.19.\n\n  It fixes a bug in our initramfs support by removing some broken and\n  obselete code\"\n\n* tag 'riscv-for-linus-4.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux:\n  riscv: Do not overwrite initrd_start and initrd_end","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/96eddb810b146e4d364e35f38dc11d16680c66eb"}]}
{"actor":{"display_login":"Noltari"}}