linux-stable.git/drivers/target, branch linux-3.13.y

iscsi-target: Fix iscsit_get_tpg_from_np tpg_state bug

2014-03-24T04:44:13+00:00

commit a2a99cea5ec7c1e47825559f0e75a4efbcf8aee3 upstream.

This patch fixes a bug in iscsit_get_tpg_from_np() where the
tpg->tpg_state sanity check was looking for TPG_STATE_FREE,
instead of != TPG_STATE_ACTIVE.

The latter is expected during a normal TPG shutdown once the
tpg_state goes into TPG_STATE_INACTIVE in order to reject any
new incoming login attempts.

Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iscsi/iser-target: Fix isert_conn->state hung shutdown issues

2014-03-24T04:44:12+00:00

commit defd884845297fd5690594bfe89656b01f16d87e upstream.

This patch addresses a couple of different hug shutdown issues
related to wait_event() + isert_conn->state.  First, it changes
isert_conn->conn_wait + isert_conn->conn_wait_comp_err from
waitqueues to completions, and sets ISER_CONN_TERMINATING from
within isert_disconnect_work().

Second, it splits isert_free_conn() into isert_wait_conn() that
is called earlier in iscsit_close_connection() to ensure that
all outstanding commands have completed before continuing.

Finally, it breaks isert_cq_comp_err() into seperate TX / RX
related code, and adds logic in isert_cq_rx_comp_err() to wait
for outstanding commands to complete before setting ISER_CONN_DOWN
and calling complete(&isert_conn->conn_wait_comp_err).

Acked-by: Sagi Grimberg 
Cc: Or Gerlitz 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iscsi/iser-target: Use list_del_init for ->i_conn_node

2014-03-24T04:44:12+00:00

commit 5159d763f60af693a3fcec45dce2021f66e528a4 upstream.

There are a handful of uses of list_empty() for cmd->i_conn_node
within iser-target code that expect to return false once a cmd
has been removed from the per connect list.

This patch changes all uses of list_del -> list_del_init in order
to ensure that list_empty() returns false as expected.

Acked-by: Sagi Grimberg 
Cc: Or Gerlitz 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Fix free-after-use regression in PR unregister

2014-02-22T21:35:00+00:00

commit fc09149df6e20cfbb0bb86f10899607c321a31eb upstream.

This patch addresses a >= v3.11 free-after-use regression
in core_scsi3_emulate_pro_register() that was introduced
in the following commit:

commit bc118fe4c4a8cfa453491ba77c0a146a6d0e73e0
Author: Andy Grover 
Date:   Thu May 16 10:41:04 2013 -0700

    target: Further refactoring of core_scsi3_emulate_pro_register()

To avoid the free-after-use, save an type value before hand, and
only call core_scsi3_put_pr_reg() with a valid *pr_reg.

Reported-by: Dan Carpenter 
Cc: Andy Grover 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Fix percpu_ref_put race in transport_lun_remove_cmd

2014-02-13T21:55:41+00:00

commit 5259a06ef97068b710f45d092a587e8d740f750f upstream.

This patch fixes a percpu_ref_put race for se_lun->lun_ref in
transport_lun_remove_cmd() where ->lun_ref could end up being
put more than once per command via different target completion
and fabric release contexts.

It adds a cmpxchg() for se_cmd->lun_ref_active to ensure that
percpu_ref_put() is only ever called once per se_cmd.

This bug was manifesting itself as a LUN shutdown regression
bug in >= v3.13 code, where percpu_ref_kill() would end up
hanging indefinately due to the incorrect percpu_ref count.

(Change se_cmd->lun_ref_active from bool -> int to force at
 least a 4-byte cmpxchg with MIPS ll/sc ins. - Fengguang)

Reported-by: Tommy Apel 
Cc: Tommy Apel 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iscsi-target: Fix connection reset hang with percpu_ida_alloc

2014-02-13T21:55:36+00:00

commit 555b270e25b0279b98083518a85f4b1da144a181 upstream.

This patch addresses a bug where connection reset would hang
indefinately once percpu_ida_alloc() was starved for tags, due
to the fact that it always assumed uninterruptible sleep mode.

So now make percpu_ida_alloc() check for signal_pending_state() for
making interruptible sleep optional, and convert iscsit_allocate_cmd()
to set TASK_INTERRUPTIBLE for GFP_KERNEL, or TASK_RUNNING for
GFP_ATOMIC.

Reported-by: Linus Torvalds 
Cc: Kent Overstreet 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

percpu_ida: Make percpu_ida_alloc + callers accept task state bitmask

2014-02-13T21:55:36+00:00

commit 6f6b5d1ec56acdeab0503d2b823f6f88a0af493e upstream.

This patch changes percpu_ida_alloc() + callers to accept task state
bitmask for prepare_to_wait() for code like target/iscsi that needs
it for interruptible sleep, that is provided in a subsequent patch.

It now expects TASK_UNINTERRUPTIBLE when the caller is able to sleep
waiting for a new tag, or TASK_RUNNING when the caller cannot sleep,
and is forced to return a negative value when no tags are available.

v2 changes:
  - Include blk-mq + tcm_fc + vhost/scsi + target/iscsi changes
  - Drop signal_pending_state() call
v3 changes:
  - Only call prepare_to_wait() + finish_wait() when != TASK_RUNNING
    (PeterZ)

Reported-by: Linus Torvalds 
Cc: Linus Torvalds 
Cc: Ingo Molnar 
Cc: Peter Zijlstra 
Cc: Jens Axboe 
Signed-off-by: Kent Overstreet 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target/iscsi: Fix network portal creation race

2014-02-06T19:34:11+00:00

commit ee291e63293146db64668e8d65eb35c97e8324f4 upstream.

When creating network portals rapidly, such as when restoring a
configuration, LIO's code to reuse existing portals can return a false
negative if the thread hasn't run yet and set np_thread_state to
ISCSI_NP_THREAD_ACTIVE. This causes an error in the network stack
when attempting to bind to the same address/port.

This patch sets NP_THREAD_ACTIVE before the np is placed on g_np_list,
so even if the thread hasn't run yet, iscsit_get_np will return the
existing np.

Also, convert np_lock -> np_mutex + hold across adding new net portal
to g_np_list to prevent a race where two threads may attempt to create
the same network portal, resulting in one of them failing.

(nab: Add missing mutex_unlocks in iscsit_add_np failure paths)
(DanC: Fix incorrect spin_unlock -> spin_unlock_bh)

Signed-off-by: Andy Grover 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iscsi-target: Pre-allocate more tags to avoid ack starvation

2014-02-06T19:34:11+00:00

commit 4a4caa29f1abcb14377e05d57c0793d338fb945d upstream.

This patch addresses an traditional iscsi-target fabric ack starvation
issue where iscsit_allocate_cmd() -> percpu_ida_alloc_state() ends up
hitting slow path percpu-ida code, because iscsit_ack_from_expstatsn()
is expected to free ack'ed tags after tag allocation.

This is done to take into account the tags waiting to be acknowledged
and released in iscsit_ack_from_expstatsn(), but who's number are not
directly limited by the CmdSN Window queue_depth being enforced by
the target.

So that said, this patch bumps up the pre-allocated number of
per session tags to:

  (max(queue_depth, ISCSIT_MIN_TAGS) * 2) + ISCSIT_EXTRA_TAGS

for good measure to avoid the percpu_ida_alloc_state() slow path.

Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Remove extra percpu_ref_init

2013-12-19T22:49:54+00:00

lun->lun_ref is also initialized in core_tpg_post_addlun, so it doesn't
need to be done in core_tpg_setup_virtual_lun0.

(nab: Drop left-over percpu_ref_cancel_init in failure path)

Signed-off-by: Andy Grover 
Signed-off-by: Nicholas Bellinger