scsi: libiscsi: Add iscsi_cls_conn to sysfs after initialization

iscsi_create_conn() exposed iscsi_cls_conn to sysfs prior to initialization
of iscsi_conn's dd_data. When userspace tried to access an attribute such
as the connect address, a NULL pointer dereference was observed.

Do not add iscsi_cls_conn to sysfs until it has been initialized.  Remove
iscsi_create_conn() since it is no longer used.

Link: https://lore.kernel.org/r/20220310015759.3296841-3-haowenchao@huawei.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Wenchao Hao <haowenchao@huawei.com>
Signed-off-by: Wu Bo <wubo40@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index c84c2a3..69ddc9f 100644 (file)
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -3038,8 +3038,9 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
        struct iscsi_conn *conn;
        struct iscsi_cls_conn *cls_conn;
        char *data;
+       int err;
 
-       cls_conn = iscsi_create_conn(cls_session, sizeof(*conn) + dd_size,
+       cls_conn = iscsi_alloc_conn(cls_session, sizeof(*conn) + dd_size,
                                     conn_idx);
        if (!cls_conn)
                return NULL;
@@ -3076,13 +3077,21 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
                goto login_task_data_alloc_fail;
        conn->login_task->data = conn->data = data;
 
+       err = iscsi_add_conn(cls_conn);
+       if (err)
+               goto login_task_add_dev_fail;
+
        return cls_conn;
 
+login_task_add_dev_fail:
+       free_pages((unsigned long) conn->data,
+                  get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
+
 login_task_data_alloc_fail:
        kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
                    sizeof(void*));
 login_task_alloc_fail:
-       iscsi_destroy_conn(cls_conn);
+       iscsi_put_conn(cls_conn);
        return NULL;
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_setup);

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index fe58633..803b6b0 100644 (file)
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2414,82 +2414,6 @@ void iscsi_remove_conn(struct iscsi_cls_conn *conn)
 }
 EXPORT_SYMBOL_GPL(iscsi_remove_conn);
 
-/**
- * iscsi_create_conn - create iscsi class connection
- * @session: iscsi cls session
- * @dd_size: private driver data size
- * @cid: connection id
- *
- * This can be called from a LLD or iscsi_transport. The connection
- * is child of the session so cid must be unique for all connections
- * on the session.
- *
- * Since we do not support MCS, cid will normally be zero. In some cases
- * for software iscsi we could be trying to preallocate a connection struct
- * in which case there could be two connection structs and cid would be
- * non-zero.
- */
-struct iscsi_cls_conn *
-iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
-{
-       struct iscsi_transport *transport = session->transport;
-       struct iscsi_cls_conn *conn;
-       unsigned long flags;
-       int err;
-
-       conn = kzalloc(sizeof(*conn) + dd_size, GFP_KERNEL);
-       if (!conn)
-               return NULL;
-       if (dd_size)
-               conn->dd_data = &conn[1];
-
-       mutex_init(&conn->ep_mutex);
-       INIT_LIST_HEAD(&conn->conn_list);
-       INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn);
-       conn->transport = transport;
-       conn->cid = cid;
-       conn->state = ISCSI_CONN_DOWN;
-
-       /* this is released in the dev's release function */
-       if (!get_device(&session->dev))
-               goto free_conn;
-
-       dev_set_name(&conn->dev, "connection%d:%u", session->sid, cid);
-       conn->dev.parent = &session->dev;
-       conn->dev.release = iscsi_conn_release;
-       err = device_register(&conn->dev);
-       if (err) {
-               iscsi_cls_session_printk(KERN_ERR, session, "could not "
-                                        "register connection's dev\n");
-               goto release_parent_ref;
-       }
-       err = transport_register_device(&conn->dev);
-       if (err) {
-               iscsi_cls_session_printk(KERN_ERR, session, "could not "
-                                        "register transport's dev\n");
-               goto release_conn_ref;
-       }
-
-       spin_lock_irqsave(&connlock, flags);
-       list_add(&conn->conn_list, &connlist);
-       spin_unlock_irqrestore(&connlock, flags);
-
-       ISCSI_DBG_TRANS_CONN(conn, "Completed conn creation\n");
-       return conn;
-
-release_conn_ref:
-       device_unregister(&conn->dev);
-       put_device(&session->dev);
-       return NULL;
-release_parent_ref:
-       put_device(&session->dev);
-free_conn:
-       kfree(conn);
-       return NULL;
-}
-
-EXPORT_SYMBOL_GPL(iscsi_create_conn);
-
 /**
  * iscsi_destroy_conn - destroy iscsi class connection
  * @conn: iscsi cls session

diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index ad34183..97e9479 100644 (file)
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -446,8 +446,6 @@ extern struct iscsi_cls_conn *iscsi_alloc_conn(struct iscsi_cls_session *sess,
                                                int dd_size, uint32_t cid);
 extern int iscsi_add_conn(struct iscsi_cls_conn *conn);
 extern void iscsi_remove_conn(struct iscsi_cls_conn *conn);
-extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
-                                               int dd_size, uint32_t cid);
 extern void iscsi_put_conn(struct iscsi_cls_conn *conn);
 extern void iscsi_get_conn(struct iscsi_cls_conn *conn);
 extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);