linux-stable.git/drivers/target, branch v3.18.28

target: Fix LUN_RESET active TMR descriptor handling

2016-03-02T20:18:56+00:00

[ Upstream commit a6d9bb1c9605cd4f44e2d8290dc4d0e88f20292d ]

This patch fixes a NULL pointer se_cmd->cmd_kref < 0
refcount bug during TMR LUN_RESET with active TMRs,
triggered during se_cmd + se_tmr_req descriptor
shutdown + release via core_tmr_drain_tmr_list().

To address this bug, go ahead and obtain a local
kref_get_unless_zero(&se_cmd->cmd_kref) for active I/O
to set CMD_T_ABORTED, and transport_wait_for_tasks()
followed by the final target_put_sess_cmd() to drop
the local ->cmd_kref.

Also add two new checks within target_tmr_work() to
avoid CMD_T_ABORTED -> TFO->queue_tm_rsp() callbacks
ahead of invoking the backend -> fabric put in
transport_cmd_check_stop_to_fabric().

For good measure, also change core_tmr_release_req()
to use list_del_init() ahead of se_tmr_req memory
free.

Reviewed-by: Quinn Tran 
Cc: Himanshu Madhani 
Cc: Sagi Grimberg 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Andy Grover 
Cc: Mike Christie 
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target: Remove first argument of target_{get,put}_sess_cmd()

2016-03-02T20:18:56+00:00

[ Upstream commit afc16604c06414223478df3e42301ab630b9960a ]

The first argument of these two functions is always identical
to se_cmd->se_sess. Hence remove the first argument.

Signed-off-by: Bart Van Assche 
Reviewed-by: Sagi Grimberg 
Reviewed-by: Christoph Hellwig 
Cc: Andy Grover 
Cc: 
Cc: Felipe Balbi 
Cc: Michael S. Tsirkin 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi-target: Fix potential dead-lock during node acl delete

2016-02-10T03:57:36+00:00

[ Upstream commit 26a99c19f810b2593410899a5b304b21b47428a6 ]

This patch is a iscsi-target specific bug-fix for a dead-lock
that can occur during explicit struct se_node_acl->acl_group
se_session deletion via configfs rmdir(2), when iscsi-target
time2retain timer is still active.

It changes iscsi-target to obtain se_portal_group->session_lock
internally using spin_in_locked() to check for the specific
se_node_acl configfs shutdown rmdir(2) case.

Note this patch is intended for stable, and the subsequent
v4.5-rc patch converts target_core_tpg.c to use proper
se_sess->sess_kref reference counting for both se_node_acl
deletion + se_node_acl->queue_depth se_session restart.

Reported-by:: Sagi Grimberg 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Andy Grover 
Cc: Mike Christie 
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target/iscsi: Fix np_ip bracket issue by removing np_ip

2015-10-28T02:12:52+00:00

[ Upstream commit 76c28f1fcfeb42b47f798fe498351ee1d60086ae ]

Revert commit 1997e6259, which causes double brackets on ipv6
inaddr_any addresses.

Since we have np_sockaddr, if we need a textual representation we can
use "%pISc".

Change iscsit_add_network_portal() and iscsit_add_np() signatures to remove
*ip_str parameter.

Fix and extend some comments earlier in the function.

Tested to work for :: and ::1 via iscsiadm, previously :: failed, see
https://bugzilla.redhat.com/show_bug.cgi?id=1249107 .

CC: stable@vger.kernel.org
Signed-off-by: Andy Grover 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi-target: Fix iscsit_start_kthreads failure OOPs

2015-08-27T17:25:53+00:00

[ Upstream commit e54198657b65625085834847ab6271087323ffea ]

This patch fixes a regression introduced with the following commit
in v4.0-rc1 code, where a iscsit_start_kthreads() failure triggers
a NULL pointer dereference OOPs:

    commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca
    Author: Nicholas Bellinger 
    Date:   Thu Feb 26 22:19:15 2015 -0800

        iscsi-target: Convert iscsi_thread_set usage to kthread.h

To address this bug, move iscsit_start_kthreads() immediately
preceeding the transmit of last login response, before signaling
a successful transition into full-feature-phase within existing
iscsi_target_do_tx_login_io() logic.

This ensures that no target-side resource allocation failures can
occur after the final login response has been successfully sent.

Also, it adds a iscsi_conn->rx_login_comp to allow the RX thread
to sleep to prevent other socket related failures until the final
iscsi_post_login_handler() call is able to complete.

Cc: Sagi Grimberg 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi-target: Fix iser explicit logout TX kthread leak

2015-08-27T17:25:52+00:00

[ Upstream commit 007d038bdf95ccfe2491d0078be54040d110fd06 ]

This patch fixes a regression introduced with the following commit
in v4.0-rc1 code, where an explicit iser-target logout would result
in ->tx_thread_active being incorrectly cleared by the logout post
handler, and subsequent TX kthread leak:

    commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca
    Author: Nicholas Bellinger 
    Date:   Thu Feb 26 22:19:15 2015 -0800

        iscsi-target: Convert iscsi_thread_set usage to kthread.h

To address this bug, change iscsit_logout_post_handler_closesession()
and iscsit_logout_post_handler_samecid() to only cmpxchg() on
->tx_thread_active for traditional iscsi/tcp connections.

This is required because iscsi/tcp connections are invoking logout
post handler logic directly from TX kthread context, while iser
connections are invoking logout post handler logic from a seperate
workqueue context.

Cc: Sagi Grimberg 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi-target: Fix use-after-free during TPG session shutdown

2015-08-27T17:25:51+00:00

[ Upstream commit 417c20a9bdd1e876384127cf096d8ae8b559066c ]

This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
where se_portal_group->session_lock was incorrectly released/re-acquired
while walking the active se_portal_group->tpg_sess_list.

The can result in a NULL pointer dereference when iscsit_close_session()
shutdown happens in the normal path asynchronously to this code, causing
a bogus dereference of an already freed list entry to occur.

To address this bug, walk the session list checking for the same state
as before, but move entries to a local list to avoid dropping the lock
while walking the active list.

As before, signal using iscsi_session->session_restatement=1 for those
list entries to be released locally by iscsit_free_session() code.

Reported-by: Sunilkumar Nadumuttlu 
Cc: Sunilkumar Nadumuttlu 
Cc:  # v3.1+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi-target: Convert iscsi_thread_set usage to kthread.h

2015-08-04T18:34:17+00:00

[ Upstream commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca ]

This patch converts iscsi-target code to use modern kthread.h API
callers for creating RX/TX threads for each new iscsi_conn descriptor,
and releasing associated RX/TX threads during connection shutdown.

This is done using iscsit_start_kthreads() -> kthread_run() to start
new kthreads from within iscsi_post_login_handler(), and invoking
kthread_stop() from existing iscsit_close_connection() code.

Also, convert iscsit_logout_post_handler_closesession() code to use
cmpxchg when determing when iscsit_cause_connection_reinstatement()
needs to sleep waiting for completion.

Reported-by: Sagi Grimberg 
Tested-by: Sagi Grimberg 
Cc: Slava Shwartsman 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST

2015-06-10T17:42:15+00:00

[ Upstream commit 5a7125c64def3b21f8147eca8b54949a60963942 ]

See https://bugzilla.redhat.com/show_bug.cgi?id=1025672

We need to put() the reference to the scsi host that we got in
pscsi_configure_device(). In VIRTUAL_HOST mode it is associated with
the dev_virt, not the hba_virt.

Signed-off-by: Andy Grover 
Cc: stable@vger.kernel.org # 2.6.38+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target/file: Fix SG table for prot_buf initialization

2015-05-17T23:12:12+00:00

[ Upstream commit c836777830428372074d5129ac513e1472c99791 ]

In fd_do_prot_rw(), it allocates prot_buf which is used to copy from
se_cmd->t_prot_sg by sbc_dif_copy_prot().  The SG table for prot_buf
is also initialized by allocating 'se_cmd->t_prot_nents' entries of
scatterlist and setting the data length of each entry to PAGE_SIZE
at most.

However if se_cmd->t_prot_sg contains a clustered entry (i.e.
sg->length > PAGE_SIZE), the SG table for prot_buf can't be
initialized correctly and sbc_dif_copy_prot() can't copy to prot_buf.
(This actually happened with TCM loopback fabric module)

As prot_buf is allocated by kzalloc() and it's physically contiguous,
we only need a single scatterlist entry.

Signed-off-by: Akinobu Mita 
Cc: Sagi Grimberg 
Cc: "Martin K. Petersen" 
Cc: Christoph Hellwig 
Cc: "James E.J. Bottomley" 
Cc:  # v3.14+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin