scsi: target/core: Fix a race condition in the LUN lookup code
authorBart Van Assche <bvanassche@acm.org>
Tue, 2 Apr 2019 19:58:05 +0000 (12:58 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Sat, 13 Apr 2019 00:20:05 +0000 (20:20 -0400)
commit63f7479439c95bcd49b7dd4af809862c316c71a3
treec7c5509ade07fa7f5a6a01ff1bb7e40bfdeecb70
parenta6a6d0589ac4ff3e1eb962f6c53e67d8f6386c18
scsi: target/core: Fix a race condition in the LUN lookup code

The rcu_dereference(deve->se_lun) expression occurs twice in the LUN lookup
functions. Since these expressions are not serialized against deve->se_lun
assignments each of these expressions may yield a different result. Avoid
that the wrong LUN pointer is stored in se_cmd by reading deve->se_lun only
once.

Cc: Mike Christie <mchristi@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Fixes: 29a05deebf6c ("target: Convert se_node_acl->device_list[] to RCU hlist") # v4.10
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/target/target_core_device.c