Bug 106251 - there exists a wrong return value of function iscsi_if_recv_msg() when iscsi_lookup_endpoint() fails
Summary: there exists a wrong return value of function iscsi_if_recv_msg() when iscsi_...
Status: NEW
Alias: None
Product: SCSI Drivers
Classification: Unclassified
Component: Other (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: scsi_drivers-other
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-10-19 14:17 UTC by RUC_Soft_Sec
Modified: 2015-10-19 14:17 UTC (History)
0 users

See Also:
Kernel Version: 4.2
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description RUC_Soft_Sec 2015-10-19 14:17:48 UTC
In function iscsi_if_recv_msg() at drivers/scsi/scsi_transport_iscsi.c:3491, the call to iscsi_lookup_endpoint() in line 3575 may fail, and thus function iscsi_if_recv_msg() will return the value of variable 'err'. And, the function iscsi_if_recv_msg() will return 0 at last when it runs well. So the function iscsi_if_recv_msg() will return 0 to its caller functions when it runs error because of the failing call to iscsi_lookup_endpoint(), leading to a wrong return value in function iscsi_if_recv_msg().
The related code snippets in iscsi_if_recv_msg() are as following.
iscsi_if_recv_msg @@ drivers/scsi/scsi_transport_iscsi.c:3491
3491 static int
3492 iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
3493 {
3494         int err = 0;
                     ......
3575                 ep = iscsi_lookup_endpoint(ev->u.b_conn.transport_eph);
3576                 if (ep) {
3577                         ep->conn = conn;
3578 
3579                         mutex_lock(&conn->ep_mutex);
3580                         conn->ep = ep;
3581                         mutex_unlock(&conn->ep_mutex);
3582                 } else
3583                         iscsi_cls_conn_printk(KERN_ERR, conn,
3584                                               "Could not set ep conn "
3585                                               "binding\n");
3586                 break;
                     ......
3679         return err;
3680 }


Generally, the return value of caller functions which call function iscsi_lookup_endpoint() shall be set to a negative number when the call to iscsi_lookup_endpoint() fails, like the following codes in another file.
beiscsi_conn_bind @@ drivers/scsi/be2iscsi/be_iscsi.cīŧš195
195 int beiscsi_conn_bind(struct iscsi_cls_session *cls_session,
196                       struct iscsi_cls_conn *cls_conn,
197                       u64 transport_fd, int is_leading)
198 {
            ......
208         ep = iscsi_lookup_endpoint(transport_fd);
209         if (!ep)
210                 return -EINVAL;
            ......
238 }

Thank you

RUC_Soft_Sec

Note You need to log in before you can comment on or make changes to this bug.