Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:  scsi: target: Fix recursive locking in __configfs_open_file()  In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store().  This function called filp_open(), following which these functions were called (in reverse order), according to the call trace:    down_read   __configfs_open_file   do_dentry_open   vfs_open   do_open   path_openat   do_filp_open   file_open_name   filp_open   target_core_item_dbroot_store   flush_write_buffer   configfs_write_iter  target_core_item_dbroot_store() tries to validate the new file path by trying to open the file path provided to it; however, in this case, the bug report shows:  db_root: not a directory: /sys/kernel/config/target/dbroot  indicating that the same configfs file was tried to be opened, on which it is currently working on. Thus, it is trying to acquire frag_sem semaphore of the same file of which it already holds the semaphore obtained in flush_write_buffer(), leading to acquiring the semaphore in a nested manner and a possibility of recursive locking.  Fix this by modifying target_core_item_dbroot_store() to use kern_path() instead of filp_open() to avoid opening the file using filesystem-specific function __configfs_open_file(), and further modifying it to make this fix compatible.