4 files changed, 18 insertions, 0 deletions

diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 3f604393d89c..e2695101bb99 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1352,6 +1352,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
         if (!dev)
                 return NULL;
 
+        dev->dev_link_magic = SE_DEV_LINK_MAGIC;
         dev->se_hba = hba;
         dev->transport = hba->transport;
 
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index 9c6791734ee8..810263dfa4a1 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -70,6 +70,12 @@ static int target_fabric_mappedlun_link(
         struct se_portal_group *se_tpg;
         struct config_item *nacl_ci, *tpg_ci, *tpg_ci_s, *wwn_ci, *wwn_ci_s;
         int ret = 0, lun_access;
+
+        if (lun->lun_link_magic != SE_LUN_LINK_MAGIC) {
+                pr_err("Bad lun->lun_link_magic, not a valid lun_ci pointer:"
+                        " %p to struct lun: %p\n", lun_ci, lun);
+                return -EFAULT;
+        }
         /*
          * Ensure that the source port exists
          */
@@ -742,6 +748,12 @@ static int target_fabric_port_link(
         struct target_fabric_configfs *tf;
         int ret;
 
+        if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
+                pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
+                        " %p to struct se_device: %p\n", se_dev_ci, dev);
+                return -EFAULT;
+        }
+
         tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
         se_tpg = container_of(to_config_group(tpg_ci),
                                 struct se_portal_group, tpg_group);
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index d84cc0a8739e..0163309e2aba 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -669,6 +669,7 @@ int core_tpg_register(
         for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
                 lun = se_tpg->tpg_lun_list[i];
                 lun->unpacked_lun = i;
+                lun->lun_link_magic = SE_LUN_LINK_MAGIC;
                 lun->lun_status = TRANSPORT_LUN_STATUS_FREE;
                 atomic_set(&lun->lun_acl_count, 0);
                 init_completion(&lun->lun_shutdown_comp);
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 645d90ac6097..1346ee04db5e 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -624,6 +624,8 @@ struct se_dev_stat_grps {
 };
 
 struct se_device {
+#define SE_DEV_LINK_MAGIC                       0xfeeddeef
+        u32                     dev_link_magic;
         /* RELATIVE TARGET PORT IDENTIFER Counter */
         u16                     dev_rpti_counter;
         /* Used for SAM Task Attribute ordering */
@@ -722,6 +724,8 @@ struct se_port_stat_grps {
 };
 
 struct se_lun {
+#define SE_LUN_LINK_MAGIC                       0xffff7771
+        u32                     lun_link_magic;
         /* See transport_lun_status_table */
         enum transport_lun_status_table lun_status;
         u32                     lun_access;