linux-stable.git/drivers/infiniband, branch v3.10.7

iscsi-target: Fix iscsit_sequence_cmd reject handling for iser

2013-08-04T08:51:17+00:00

commit 561bf15892375597ee59d473a704a3e634c4f311 upstream

This patch moves ISCSI_OP_REJECT failures into iscsit_sequence_cmd()
in order to avoid external iscsit_reject_cmd() reject usage for all
PDU types.

It also updates PDU specific handlers for traditional iscsi-target
code to not reset the session after posting a ISCSI_OP_REJECT during
setup.

(v2: Fix CMDSN_LOWER_THAN_EXP for ISCSI_OP_SCSI to call
     target_put_sess_cmd() after iscsit_sequence_cmd() failure)

Signed-off-by: Nicholas Bellinger 
Cc: Or Gerlitz 
Cc: Mike Christie 
Signed-off-by: Greg Kroah-Hartman

iscsi-target: Fix iscsit_add_reject* usage for iser

2013-08-04T08:51:17+00:00

commit ba159914086f06532079fc15141f46ffe7e04a41 upstream

This patch changes iscsit_add_reject() + iscsit_add_reject_from_cmd()
usage to not sleep on iscsi_cmd->reject_comp to address a free-after-use
usage bug in v3.10 with iser-target code.

It saves ->reject_reason for use within iscsit_build_reject() so the
correct value for both transport cases.  It also drops the legacy
fail_conn parameter usage throughput iscsi-target code and adds
two iscsit_add_reject_cmd() and iscsit_reject_cmd helper functions,
along with various small cleanups.

(v2: Re-enable target_put_sess_cmd() to be called from
     iscsit_add_reject_from_cmd() for rejects invoked after
     target_get_sess_cmd() has been called)

Signed-off-by: Nicholas Bellinger 
Cc: Or Gerlitz 
Cc: Mike Christie 
Signed-off-by: Greg Kroah-Hartman

iscsi-target: Fix ISCSI_OP_SCSI_TMFUNC handling for iser

2013-08-04T08:50:34+00:00

commit 186a9647019587b3784694894c4d136fd00cfd7b upstream.

This patch adds target_get_sess_cmd reference counting for
iscsit_handle_task_mgt_cmd(), and adds a target_put_sess_cmd()
for the failure case.

It also fixes a bug where ISCSI_OP_SCSI_TMFUNC type commands
where leaking iscsi_cmd->i_conn_node and eventually triggering
an OOPs during struct isert_conn shutdown.

Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iser-target: Fix session reset bug with RDMA_CM_EVENT_DISCONNECTED

2013-08-04T08:50:33+00:00

commit b2cb96494d83b894a43ba8b9023eead8ff50684b upstream.

This patch addresses a bug where RDMA_CM_EVENT_DISCONNECTED may occur
before the connection shutdown has been completed by rx/tx threads,
that causes isert_free_conn() to wait indefinately on ->conn_wait.

This patch allows isert_disconnect_work code to invoke rdma_disconnect
when isert_disconnect_work() process context is started by client
session reset before isert_free_conn() code has been reached.

It also adds isert_conn->conn_mutex protection for ->state within
isert_disconnect_work(), isert_cq_comp_err() and isert_free_conn()
code, along with isert_check_state() for wait_event usage.

(v2: Add explicit iscsit_cause_connection_reinstatement call
     during isert_disconnect_work() to force conn reset)

Cc: Or Gerlitz 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iser-target: Fix isert_put_reject payload buffer post

2013-08-04T08:50:32+00:00

commit 3df8f68aaf7ebe3d136a22262b41b350b0a1858b upstream.

This patch adds the missing isert_put_reject() logic to post
a outgoing payload buffer to hold the 48 bytes of original PDU
header request payload for the rejected cmd.

It also fixes ISTATE_SEND_REJECT handling in isert_response_completion()
-> isert_do_control_comp() code, and drops incorrect iscsi_cmd_t->reject_comp
usage.

Signed-off-by: Nicholas Bellinger 
Cc: Or Gerlitz 
Cc: Mike Christie 
Signed-off-by: Greg Kroah-Hartman

Merge branches 'iser' and 'qib' into for-next

2013-06-05T00:06:46+00:00

IB/qib: Fix lockdep splat in qib_alloc_lkey()

2013-06-05T00:05:20+00:00

The following backtrace is reported with CONFIG_PROVE_RCU:

    drivers/infiniband/hw/qib/qib_keys.c:64 suspicious rcu_dereference_check() usage!
    other info that might help us debug this:
    rcu_scheduler_active = 1, debug_locks = 1
    4 locks held by kworker/0:1/56:
    #0:  (events){.+.+.+}, at: [] process_one_work+0x165/0x4a0
    #1:  ((&wfc.work)){+.+.+.}, at: [] process_one_work+0x165/0x4a0
    #2:  (device_mutex){+.+.+.}, at: [] ib_register_device+0x38/0x220 [ib_core]
    #3:  (&(&dev->lk_table.lock)->rlock){......}, at: [] qib_alloc_lkey+0x3c/0x1b0 [ib_qib]

    stack backtrace:
    Pid: 56, comm: kworker/0:1 Not tainted 3.10.0-rc1+ #6
    Call Trace:
    [] lockdep_rcu_suspicious+0xe5/0x130
    [] qib_alloc_lkey+0x101/0x1b0 [ib_qib]
    [] qib_get_dma_mr+0xa6/0xd0 [ib_qib]
    [] ib_get_dma_mr+0x1a/0x50 [ib_core]
    [] ib_mad_port_open+0x12c/0x390 [ib_mad]
    [] ?  trace_hardirqs_on_caller+0x105/0x190
    [] ib_mad_init_device+0x52/0x110 [ib_mad]
    [] ?  sl2vl_attr_show+0x30/0x30 [ib_qib]
    [] ib_register_device+0x1a9/0x220 [ib_core]
    [] qib_register_ib_device+0x735/0xa40 [ib_qib]
    [] ? mod_timer+0x118/0x220
    [] qib_init_one+0x1e5/0x400 [ib_qib]
    [] local_pci_probe+0x4e/0x90
    [] work_for_cpu_fn+0x18/0x30
    [] process_one_work+0x1d6/0x4a0
    [] ?  process_one_work+0x165/0x4a0
    [] worker_thread+0x119/0x370
    [] ?  manage_workers+0x180/0x180
    [] kthread+0xee/0x100
    [] ?  __init_kthread_worker+0x70/0x70
    [] ret_from_fork+0x7c/0xb0
    [] ?  __init_kthread_worker+0x70/0x70

Per Documentation/RCU/lockdep-splat.txt, the code now uses rcu_access_pointer()
vs. rcu_dereference().

Reported-by: Jay Fenlason 
Reviewed-by: Dean Luick 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier

IB/iser: Add Mellanox copyright

2013-06-05T00:03:12+00:00

Add Mellanox copyright to the iser initiator source code which I maintain.

Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier

IB/iser: Fix device removal flow

2013-06-05T00:03:11+00:00

Change the code to destroy the "last opened" rdma_cm id after making
sure we released all other objects (QP, CQs, PD, etc) associated with
the IB device.

Since iser accesses the IB device using the rdma_cm id, we need to
free any objects that are related to the device that is associated
with the rdma_cm id prior to destroying that id.  When this isn't
done, the low level driver that created this device can be unloaded
before iser has a chance to free all the objects and a such a call may
invoke code segment which isn't valid any more and crash.

Cc: Sean Hefty 
Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier

ib_srpt: Call target_sess_cmd_list_set_waiting during shutdown_session

2013-05-30T04:30:46+00:00

Given that srpt_release_channel_work() calls target_wait_for_sess_cmds()
to allow outstanding se_cmd_t->cmd_kref a change to complete, the call
to perform target_sess_cmd_list_set_waiting() needs to happen in
srpt_shutdown_session()

Also, this patch adds an explicit call to srpt_shutdown_session() within
srpt_drain_channel() so that target_sess_cmd_list_set_waiting() will be
called in the cases where TFO->shutdown_session() is not triggered
directly by TCM.

Cc: Joern Engel 
Cc: Roland Dreier 
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger