Re: [PATCH 2/2] xen/scsiback: free the command tag on the TMR submit-failure path

[Juergen Gross]

On 11.06.26 14:30, Michael Bommarito wrote:
> scsiback_device_action() obtains a command tag in
> scsiback_get_pend_req() and submits a task-management request with
> target_submit_tmr(). When target_submit_tmr() fails it returns < 0
> and scsiback jumps to the err: label, which sends a response but
> frees nothing, leaking the tag.
>
> Impact: a pvSCSI guest can leak the command tags of a LUN's
> session, stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or
> RESET requests whenever target_submit_tmr() fails.
>
> transport_generic_free_cmd() cannot be used here. By the time
> target_submit_tmr() returns an error it has already run
> __target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on
> its target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req
> via core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and
> the pointer dangling. Letting the command release run
> target_free_cmd_mem() would then double-free se_tmr_req.
>
> Use the same helper, which returns just the tag, on this path too.
>
> Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito@xxxxxxxxx>

Reviewed-by: Juergen Gross <jgross@xxxxxxxx>


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature