mirror of
https://github.com/torvalds/linux.git
synced 2025-11-04 02:30:34 +02:00
2896c93811
When attempting to match EXTENDED COPY CSCD descriptors with corresponding
se_devices, target_xcopy_locate_se_dev_e4() currently iterates over LIO's
global devices list which includes all configured backstores.
This change ensures that only initiator-accessible backstores are
considered during CSCD descriptor lookup, according to the session's
se_node_acl LUN list.
To avoid LUN removal race conditions, device pinning is changed from being
configfs based to instead using the se_node_acl lun_ref.
Reference: CVE-2020-28374
Fixes: cbf031f425 ("target: Add support for EXTENDED_COPY copy offload emulation")
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: David Disseldorp <ddiss@suse.de>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
68 lines
1.9 KiB
C
68 lines
1.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#include <target/target_core_base.h>
|
|
|
|
#define XCOPY_HDR_LEN 16
|
|
#define XCOPY_TARGET_DESC_LEN 32
|
|
#define XCOPY_SEGMENT_DESC_LEN 28
|
|
#define XCOPY_NAA_IEEE_REGEX_LEN 16
|
|
#define XCOPY_MAX_SECTORS 4096
|
|
|
|
/*
|
|
* SPC4r37 6.4.6.1
|
|
* Table 150 — CSCD descriptor ID values
|
|
*/
|
|
#define XCOPY_CSCD_DESC_ID_LIST_OFF_MAX 0x07FF
|
|
|
|
enum xcopy_origin_list {
|
|
XCOL_SOURCE_RECV_OP = 0x01,
|
|
XCOL_DEST_RECV_OP = 0x02,
|
|
};
|
|
|
|
struct xcopy_op {
|
|
int op_origin;
|
|
|
|
struct se_cmd *xop_se_cmd;
|
|
struct se_device *src_dev;
|
|
unsigned char src_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
|
|
struct se_device *dst_dev;
|
|
unsigned char dst_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
|
|
unsigned char local_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
|
|
struct percpu_ref *remote_lun_ref;
|
|
|
|
sector_t src_lba;
|
|
sector_t dst_lba;
|
|
unsigned short stdi;
|
|
unsigned short dtdi;
|
|
unsigned short nolb;
|
|
|
|
u32 xop_data_bytes;
|
|
u32 xop_data_nents;
|
|
struct scatterlist *xop_data_sg;
|
|
struct work_struct xop_work;
|
|
};
|
|
|
|
/*
|
|
* Receive Copy Results Sevice Actions
|
|
*/
|
|
#define RCR_SA_COPY_STATUS 0x00
|
|
#define RCR_SA_RECEIVE_DATA 0x01
|
|
#define RCR_SA_OPERATING_PARAMETERS 0x03
|
|
#define RCR_SA_FAILED_SEGMENT_DETAILS 0x04
|
|
|
|
/*
|
|
* Receive Copy Results defs for Operating Parameters
|
|
*/
|
|
#define RCR_OP_MAX_TARGET_DESC_COUNT 0x2
|
|
#define RCR_OP_MAX_SG_DESC_COUNT 0x1
|
|
#define RCR_OP_MAX_DESC_LIST_LEN 1024
|
|
#define RCR_OP_MAX_SEGMENT_LEN 268435456 /* 256 MB */
|
|
#define RCR_OP_TOTAL_CONCURR_COPIES 0x1 /* Must be <= 16384 */
|
|
#define RCR_OP_MAX_CONCURR_COPIES 0x1 /* Must be <= 255 */
|
|
#define RCR_OP_DATA_SEG_GRAN_LOG2 9 /* 512 bytes in log 2 */
|
|
#define RCR_OP_INLINE_DATA_GRAN_LOG2 9 /* 512 bytes in log 2 */
|
|
#define RCR_OP_HELD_DATA_GRAN_LOG2 9 /* 512 bytes in log 2 */
|
|
|
|
extern int target_xcopy_setup_pt(void);
|
|
extern void target_xcopy_release_pt(void);
|
|
extern sense_reason_t target_do_xcopy(struct se_cmd *);
|
|
extern sense_reason_t target_do_receive_copy_results(struct se_cmd *);
|