github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-05 21:15:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

scsi: core: Restrict legal sdev_state transitions via sysfs

Browse Source 
[ Upstream commit 2331ce6126 ]

Userspace can currently write to sysfs to transition sdev_state to RUNNING
or OFFLINE from any source state. This causes issues because proper
transitioning out of some states involves steps besides just changing
sdev_state, so allowing userspace to change sdev_state regardless of the
source state can result in inconsistencies; e.g. with ISCSI we can end up
with sdev_state == SDEV_RUNNING while the device queue is quiesced. Any
task attempting I/O on the device will then hang, and in more recent
kernels, iscsid will hang as well.

More detail about this bug is provided in my first attempt:

https://groups.google.com/g/open-iscsi/c/PNKca4HgPDs/m/CXaDkntOAQAJ

Link: https://lore.kernel.org/r/20220924000241.2967323-1-ushankar@purestorage.com
Signed-off-by: Uday Shankar <ushankar@purestorage.com>
Suggested-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Uday Shankar 2022-09-23 18:02:42 -06:00 committed by Greg Kroah-Hartman
parent 9edf20e5a1
commit ff06067b70
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/scsi/scsi_sysfs.c
View File

@ -815,6 +815,14 @@ store_state_field(struct device *dev, struct device_attribute *attr,
} }
mutex_lock(&sdev->state_mutex); mutex_lock(&sdev->state_mutex);
switch (sdev->sdev_state) {
case SDEV_RUNNING:
case SDEV_OFFLINE:
break;
default:
mutex_unlock(&sdev->state_mutex);
return -EINVAL;
}
if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) {
ret = 0; ret = 0;
} else { } else {