summaryrefslogtreecommitdiffstats
path: root/drivers/target
diff options
context:
space:
mode:
authorDavid Disseldorp <ddiss@suse.de>2017-10-19 01:39:19 +0200
committerNicholas Bellinger <nab@linux-iscsi.org>2017-11-04 15:00:17 -0700
commitbdc79f0ed12ff55a9b56a91da04d0c8d8a786b9c (patch)
tree6742beee0ec5e5dbc078c4362392491294f76af0 /drivers/target
parent1ae01724ae92004be36a6c11c4d5a9f94e915204 (diff)
downloadlinux-bdc79f0ed12ff55a9b56a91da04d0c8d8a786b9c.tar.bz2
target: fix PR state file path truncation
If an LIO backstore is configured with a sufficiently long Unit Serial string, alongside a similarly long dbroot path, then a truncated Persistent Reservation APTPL state file path will be used. This truncation can unintentionally lead to two LUs with differing serial numbers sharing PR state file. Fixes: fdddf932269a ("target: use new "dbroot" target attribute") Signed-off-by: David Disseldorp <ddiss@suse.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target')
-rw-r--r--drivers/target/target_core_pr.c16
1 files changed, 7 insertions, 9 deletions
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index a54490709811..3d2b46472dfd 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1973,24 +1973,21 @@ static int __core_scsi3_write_aptpl_to_file(
struct t10_wwn *wwn = &dev->t10_wwn;
struct file *file;
int flags = O_RDWR | O_CREAT | O_TRUNC;
- char path[512];
+ char *path;
u32 pr_aptpl_buf_len;
int ret;
loff_t pos = 0;
- memset(path, 0, 512);
-
- if (strlen(&wwn->unit_serial[0]) >= 512) {
- pr_err("WWN value for struct se_device does not fit"
- " into path buffer\n");
- return -EMSGSIZE;
- }
+ path = kasprintf(GFP_KERNEL, "%s/pr/aptpl_%s", db_root,
+ &wwn->unit_serial[0]);
+ if (!path)
+ return -ENOMEM;
- snprintf(path, 512, "%s/pr/aptpl_%s", db_root, &wwn->unit_serial[0]);
file = filp_open(path, flags, 0600);
if (IS_ERR(file)) {
pr_err("filp_open(%s) for APTPL metadata"
" failed\n", path);
+ kfree(path);
return PTR_ERR(file);
}
@@ -2001,6 +1998,7 @@ static int __core_scsi3_write_aptpl_to_file(
if (ret < 0)
pr_debug("Error writing APTPL metadata file: %s\n", path);
fput(file);
+ kfree(path);
return (ret < 0) ? -EIO : 0;
}