The branch stable/13 has been updated by zlei:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=eeecaa064c8d4ba0f4a17739527ef285ee56fd36

commit eeecaa064c8d4ba0f4a17739527ef285ee56fd36
Author:     Edward Tomasz Napierala <tr...@freebsd.org>
AuthorDate: 2021-07-21 09:18:15 +0000
Commit:     Zhenlei Huang <z...@freebsd.org>
CommitDate: 2025-01-20 12:39:27 +0000

    cam: clear stack-allocated CCB in the target layer
    
    Note that, as pointed out by scottl@, this code should really look
    a bit different, in that the stack allocations should be replaced
    with dynamic allocation, and the periph creation should be moved
    to a context where one can use M_WAITOK.  See the review for more
    details.  For now let's go with a minimal fix until we're done with
    UMA CCBs.
    
    Reviewed By:    mav, imp
    Sponsored by:   NetApp, Inc.
    Sponsored by:   Klara, Inc.
    Differential Revision:  https://reviews.freebsd.org/D30298
    
    (cherry picked from commit 616a676a0535eca78ce6b02a6226d0bcb69d7d4e)
---
 sys/cam/ctl/scsi_ctl.c      | 3 +++
 sys/cam/scsi/scsi_targ_bh.c | 7 +++++--
 sys/cam/scsi/scsi_target.c  | 4 +++-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/sys/cam/ctl/scsi_ctl.c b/sys/cam/ctl/scsi_ctl.c
index 4bc7091337ca..d3a3e299a213 100644
--- a/sys/cam/ctl/scsi_ctl.c
+++ b/sys/cam/ctl/scsi_ctl.c
@@ -477,6 +477,7 @@ ctlferegister(struct cam_periph *periph, void *arg)
                    /*getcount_only*/1);
        }
 
+       memset(&ccb, 0, sizeof(ccb));
        xpt_setup_ccb(&ccb.ccb_h, periph->path, CAM_PRIORITY_NONE);
        ccb.ccb_h.func_code = XPT_EN_LUN;
        ccb.cel.grp6_len = 0;
@@ -611,6 +612,7 @@ ctlfeoninvalidate(struct cam_periph *periph)
        cam_status status;
 
        /* Abort all ATIOs and INOTs queued to SIM. */
+       memset(&ccb, 0, sizeof(ccb));
        xpt_setup_ccb(&ccb.ccb_h, periph->path, CAM_PRIORITY_NONE);
        ccb.ccb_h.func_code = XPT_ABORT;
        LIST_FOREACH(hdr, &softc->atio_list, periph_links.le) {
@@ -1850,6 +1852,7 @@ ctlfe_dump_queue(struct ctlfe_lun_softc *softc)
        struct ccb_getdevstats cgds;
        int num_items;
 
+       memset(&cgds, 0, sizeof(cgds));
        xpt_setup_ccb(&cgds.ccb_h, periph->path, CAM_PRIORITY_NORMAL);
        cgds.ccb_h.func_code = XPT_GDEV_STATS;
        xpt_action((union ccb *)&cgds);
diff --git a/sys/cam/scsi/scsi_targ_bh.c b/sys/cam/scsi/scsi_targ_bh.c
index ae105ea03356..7b543763c521 100644
--- a/sys/cam/scsi/scsi_targ_bh.c
+++ b/sys/cam/scsi/scsi_targ_bh.c
@@ -239,6 +239,7 @@ targbhenlun(struct cam_periph *periph)
        if ((softc->flags & TARGBH_FLAG_LUN_ENABLED) != 0)
                return (CAM_REQ_CMP);
 
+       memset(&immed_ccb, 0, sizeof(immed_ccb));
        xpt_setup_ccb(&immed_ccb.ccb_h, periph->path, CAM_PRIORITY_NORMAL);
        immed_ccb.ccb_h.func_code = XPT_EN_LUN;
 
@@ -265,7 +266,7 @@ targbhenlun(struct cam_periph *periph)
                struct ccb_accept_tio *atio;
 
                atio = (struct ccb_accept_tio*)malloc(sizeof(*atio), M_SCSIBH,
-                                                     M_NOWAIT);
+                                                     M_ZERO | M_NOWAIT);
                if (atio == NULL) {
                        status = CAM_RESRC_UNAVAIL;
                        break;
@@ -307,7 +308,7 @@ targbhenlun(struct cam_periph *periph)
                struct ccb_immediate_notify *inot;
 
                inot = (struct ccb_immediate_notify*)malloc(sizeof(*inot),
-                           M_SCSIBH, M_NOWAIT);
+                           M_SCSIBH, M_ZERO | M_NOWAIT);
 
                if (inot == NULL) {
                        status = CAM_RESRC_UNAVAIL;
@@ -348,6 +349,8 @@ targbhdislun(struct cam_periph *periph)
        if ((softc->flags & TARGBH_FLAG_LUN_ENABLED) == 0)
                return CAM_REQ_CMP;
 
+       memset(&ccb, 0, sizeof(ccb));
+
        /* XXX Block for Continue I/O completion */
 
        /* Kill off all ACCECPT and IMMEDIATE CCBs */
diff --git a/sys/cam/scsi/scsi_target.c b/sys/cam/scsi/scsi_target.c
index 4cb8024545e1..dcec777d1604 100644
--- a/sys/cam/scsi/scsi_target.c
+++ b/sys/cam/scsi/scsi_target.c
@@ -360,6 +360,7 @@ targendislun(struct cam_path *path, int enable, int 
grp6_len, int grp7_len)
        cam_status        status;
 
        /* Tell the lun to begin answering selects */
+       memset(&en_ccb, 0, sizeof(en_ccb));
        xpt_setup_ccb(&en_ccb.ccb_h, path, CAM_PRIORITY_NORMAL);
        en_ccb.ccb_h.func_code = XPT_EN_LUN;
        /* Don't need support for any vendor specific commands */
@@ -933,7 +934,7 @@ targgetccb(struct targ_softc *softc, xpt_opcode type, int 
priority)
        int ccb_len;
 
        ccb_len = targccblen(type);
-       ccb = malloc(ccb_len, M_TARG, M_NOWAIT);
+       ccb = malloc(ccb_len, M_TARG, M_NOWAIT | M_ZERO);
        CAM_DEBUG(softc->path, CAM_DEBUG_PERIPH, ("getccb %p\n", ccb));
        if (ccb == NULL) {
                return (ccb);
@@ -1030,6 +1031,7 @@ abort_all_pending(struct targ_softc *softc)
         * Then abort all pending CCBs.
         * targdone() will return the aborted CCB via user_ccb_queue
         */
+       memset(&cab, 0, sizeof(cab));
        xpt_setup_ccb(&cab.ccb_h, softc->path, CAM_PRIORITY_NORMAL);
        cab.ccb_h.func_code = XPT_ABORT;
        cab.ccb_h.status = CAM_REQ_CMP_ERR;

Reply via email to