linux-stable.git/drivers/target, branch v3.7.3

iscsi-target: Fix CmdSN comparison (use cmd->cmd_sn instead of cmd->stat_sn)

2013-01-17T16:46:24+00:00

commit 64fe4f4f181cc2fe97d4176bf6ee6e3725ae33ec upstream.

Commit 64c13330a389 ("iscsi-target: Fix bug in handling of ExpStatSN
ACK during u32 wrap-around") introduced a bug where we compare the
wrong SN against our ExpCmdSN.

Reported-by: Ben Hutchings 
Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

sbp-target: fix error path in sbp_make_tpg()

2013-01-17T16:45:58+00:00

commit e1fe2060d7e8f58a69374135e32e90f0bb79a7fd upstream.

If the TPG memory is allocated successfully, but we fail further along
in the function, a dangling pointer to freed memory is left in the TPort
structure. This is mostly harmless, but does prevent re-trying the
operation without first removing the TPort altogether.

Reported-by: Chen Gang 
Signed-off-by: Chris Boot 
Cc: Andy Grover 
Cc: Nicholas A. Bellinger 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target/tcm_fc: fix the lockdep warning due to inconsistent lock state

2013-01-17T16:45:58+00:00

commit 9f4ad44b264f8bb61ffdd607148215566568430d upstream.

The lockdep warning below is in theory correct but it will be in really weird
rare situation that ends up that deadlock since the tcm fc session is hashed
based the rport id. Nonetheless, the complaining below is about rcu callback
that does the transport_deregister_session() is happening in softirq, where
transport_register_session() that happens earlier is not. This triggers the
lockdep warning below. So, just fix this to make lockdep happy by disabling
the soft irq before calling transport_register_session() in ft_prli.

BTW, this was found in FCoE VN2VN over two VMs, couple of create and destroy
would get this triggered.

v1: was enforcing register to be in softirq context which was not righ. See,
http://www.spinics.net/lists/target-devel/msg03614.html

v2: following comments from Roland&Nick (thanks), it seems we don't have to
do transport_deregister_session() in rcu callback, so move it into ft_sess_free()
but still do kfree() of the corresponding ft_sess struct in rcu callback to
make sure the ft_sess is not freed till the rcu callback.

...
[ 1328.370592] scsi2 : FCoE Driver
[ 1328.383429] fcoe: No FDMI support.
[ 1328.384509] host2: libfc: Link up on port (000000)
[ 1328.934229] host2: Assigned Port ID 00a292
[ 1357.232132] host2: rport 00a393: Remove port
[ 1357.232568] host2: rport 00a393: Port sending LOGO from Ready state
[ 1357.233692] host2: rport 00a393: Delete port
[ 1357.234472] host2: rport 00a393: work event 3
[ 1357.234969] host2: rport 00a393: callback ev 3
[ 1357.235979] host2: rport 00a393: Received a LOGO response closed
[ 1357.236706] host2: rport 00a393: work delete
[ 1357.237481]
[ 1357.237631] =================================
[ 1357.238064] [ INFO: inconsistent lock state ]
[ 1357.238450] 3.7.0-rc7-yikvm+ #3 Tainted: G           O
[ 1357.238450] ---------------------------------
[ 1357.238450] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[ 1357.238450] ksoftirqd/0/3 [HC0[0]:SC1[1]:HE0:SE0] takes:
[ 1357.238450]  (&(&se_tpg->session_lock)->rlock){+.?...}, at: [] transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450] {SOFTIRQ-ON-W} state was registered at:
[ 1357.238450]   [] mark_held_locks+0x6d/0x95
[ 1357.238450]   [] trace_hardirqs_on_caller+0x12d/0x197
[ 1357.238450]   [] trace_hardirqs_on+0xd/0xf
[ 1357.238450]   [] _raw_spin_unlock_irq+0x2d/0x45
[ 1357.238450]   [] __transport_register_session+0xb8/0x122 [target_core_mod]
[ 1357.238450]   [] transport_register_session+0x44/0x5a [target_core_mod]
[ 1357.238450]   [] ft_prli+0x1e3/0x275 [tcm_fc]
[ 1357.238450]   [] fc_rport_recv_req+0x95e/0xdc5 [libfc]
[ 1357.238450]   [] fc_lport_recv_els_req+0xc4/0xd5 [libfc]
[ 1357.238450]   [] fc_lport_recv_req+0x12f/0x18f [libfc]
[ 1357.238450]   [] fc_exch_recv+0x8ba/0x981 [libfc]
[ 1357.238450]   [] fcoe_percpu_receive_thread+0x47a/0x4e2 [fcoe]
[ 1357.238450]   [] kthread+0xb1/0xb9
[ 1357.238450]   [] ret_from_fork+0x7c/0xb0
[ 1357.238450] irq event stamp: 275411
[ 1357.238450] hardirqs last  enabled at (275410): [] rcu_process_callbacks+0x229/0x42a
[ 1357.238450] hardirqs last disabled at (275411): [] _raw_spin_lock_irqsave+0x22/0x8e
[ 1357.238450] softirqs last  enabled at (275394): [] __do_softirq+0x246/0x26f
[ 1357.238450] softirqs last disabled at (275399): [] run_ksoftirqd+0x29/0x62
[ 1357.238450]
[ 1357.238450] other info that might help us debug this:
[ 1357.238450]  Possible unsafe locking scenario:
[ 1357.238450]
[ 1357.238450]        CPU0
[ 1357.238450]        ----
[ 1357.238450]   lock(&(&se_tpg->session_lock)->rlock);
[ 1357.238450]   
[ 1357.238450]     lock(&(&se_tpg->session_lock)->rlock);
[ 1357.238450]
[ 1357.238450]  *** DEADLOCK ***
[ 1357.238450]
[ 1357.238450] no locks held by ksoftirqd/0/3.
[ 1357.238450]
[ 1357.238450] stack backtrace:
[ 1357.238450] Pid: 3, comm: ksoftirqd/0 Tainted: G           O 3.7.0-rc7-yikvm+ #3
[ 1357.238450] Call Trace:
[ 1357.238450]  [] print_usage_bug+0x1f5/0x206
[ 1357.238450]  [] ? save_stack_trace+0x2c/0x49
[ 1357.238450]  [] ? print_irq_inversion_bug.part.14+0x1ae/0x1ae
[ 1357.238450]  [] mark_lock+0x106/0x258
[ 1357.238450]  [] __lock_acquire+0x2e7/0xe53
[ 1357.238450]  [] ? pvclock_clocksource_read+0x48/0xb4
[ 1357.238450]  [] ? rcu_process_gp_end+0xc0/0xc9
[ 1357.238450]  [] ? transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450]  [] lock_acquire+0x119/0x143
[ 1357.238450]  [] ? transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450]  [] _raw_spin_lock_irqsave+0x54/0x8e
[ 1357.238450]  [] ? transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450]  [] transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450]  [] ? rcu_process_callbacks+0x229/0x42a
[ 1357.238450]  [] ft_sess_rcu_free+0x17/0x24 [tcm_fc]
[ 1357.238450]  [] ? ft_sess_free+0x1b/0x1b [tcm_fc]
[ 1357.238450]  [] rcu_process_callbacks+0x260/0x42a
[ 1357.238450]  [] __do_softirq+0x13a/0x26f
[ 1357.238450]  [] ? __schedule+0x65f/0x68e
[ 1357.238450]  [] run_ksoftirqd+0x29/0x62
[ 1357.238450]  [] smpboot_thread_fn+0x1a5/0x1aa
[ 1357.238450]  [] ? smpboot_unregister_percpu_thread+0x47/0x47
[ 1357.238450]  [] kthread+0xb1/0xb9
[ 1357.238450]  [] ? wait_for_common+0xbb/0x10a
[ 1357.238450]  [] ? __init_kthread_worker+0x59/0x59
[ 1357.238450]  [] ret_from_fork+0x7c/0xb0
[ 1357.238450]  [] ? __init_kthread_worker+0x59/0x59
[ 1417.440099]  rport-2:0-0: blocked FC remote port time out: removing rport

Signed-off-by: Yi Zou 
Cc: Open-FCoE 
Cc: Nicholas A. Bellinger 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target/file: Fix 32-bit highmem breakage for SGL -> iovec mapping

2013-01-17T16:45:58+00:00

commit 40ff2c3b3da35dd3a00ac6722056a59b4b3f2caf upstream.

This patch changes vectored file I/O to use kmap + kunmap when mapping
incoming SGL memory -> struct iovec in order to properly support 32-bit
highmem configurations.  This is because an extra bounce buffer may be
required when processing scatterlist pages allocated with GFP_KERNEL.

Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iscsit: use GFP_ATOMIC under spin lock

2013-01-17T16:45:57+00:00

commit 3c989d7603872bf878840f7ce3ea49b73bea4c6c upstream.

The function iscsit_build_conn_drop_async_message() is called
from iscsit_close_connection() with spin lock 'sess->conn_lock'
held, so we should use GFP_ATOMIC instead of GFP_KERNEL.

Signed-off-by: Wei Yongjun 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iscsi-target: Always send a response before terminating iSCSI connection

2013-01-17T16:45:57+00:00

commit 1c5c12c666fda27c7c494b34934a0a0631a48130 upstream.

There are some cases, for example when the initiator sends an
out-of-bounds ErrorRecoveryLevel value, where the iSCSI target
terminates the connection without sending back any error.  Audit the
login path and add appropriate iscsit_tx_login_rsp() calls to make
sure this doesn't happen.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iscsi-target: Fix bug in handling of ExpStatSN ACK during u32 wrap-around

2013-01-17T16:45:57+00:00

commit 64c13330a38935120501b19c97a3e6095747c7a1 upstream.

This patch fixes a bug in the hanlding of initiator provided ExpStatSN and
individual iscsi_cmd->stat_sn comparision during iscsi_conn->stat_sn
wrap-around within iscsit_ack_from_expstatsn() code.

This bug would manifest itself as iscsi_cmd descriptors not being Acked
by a lower ExpStatSn, causing them to be leaked until an iSCSI connection
or session reinstatement event occurs to release all commands.

Also fix up two other uses of incorrect CmdSN SNA comparison to use wrapper
usage from include/scsi/iscsi_proto.h.

Signed-off-by: Steve Hodgson 
Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Fix handling of aborted commands

2012-11-17T21:35:44+00:00

- If we stop processing an already-aborted command in
  target_execute_cmd(), then we need to complete t_transport_stop_comp
  to wake up the the TMR handling thread, or else it will end up
  waiting forever.

- If we've a already sent an "aborted" status for a command in
  transport_check_aborted_status() then we should bail out of
  transport_send_task_abort() to avoid freeing the command twice.

Signed-off-by: Roland Dreier 
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger

target: Fix incorrect usage of nested IRQ spinlocks in ABORT_TASK path

2012-11-01T07:38:45+00:00

This patch changes core_tmr_abort_task() to use spin_lock -> spin_unlock
around se_cmd->t_state_lock while spin_lock_irqsave is held via
se_sess->sess_cmd_lock.

Signed-off-by: Steve Hodgson 
Signed-off-by: Roland Dreier 
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger

iscsi-target: Fix missed wakeup race in TX thread

2012-11-01T07:38:44+00:00

The sleeping code in iscsi_target_tx_thread() is susceptible to the classic
missed wakeup race:

 - TX thread finishes handle_immediate_queue() and handle_response_queue(),
   thinks both queues are empty.
 - Another thread adds a queue entry and does wake_up_process(), which does
   nothing because the TX thread is still awake.
 - TX thread does schedule_timeout() and sleeps forever.

In practice this can kill an iSCSI connection if for example an initiator
does single-threaded writes and the target misses the wakeup window when
queueing an R2T; in this case the connection will be stuck until the
initiator loses patience and does some task management operation (or kills
the connection entirely).

Fix this by converting to wait_event_interruptible(), which does not
suffer from this sort of race.

Signed-off-by: Roland Dreier 
Cc: Andy Grover 
Cc: Hannes Reinecke 
Cc: Christoph Hellwig 
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger