linux.git/drivers/target/target_core_device.c, branch v3.0

target: Fix incorrect strlen() NULL terminator checks

2011-06-24T00:08:11+00:00

This patch fixes a number of cases in target core using an incorrectly

	if (strlen(foo) > SOME_MAX_SIZE)

As strlen() returns the number of characters in the string not counting
the NULL character at the end.  So if you do something like:

        char buf[10];

        if (strlen("0123456789") > 10)
                return -ETOOLONG;
        snprintf(buf, 10, "0123456789");
        printf("%s\n", buf);

then the last "9" gets chopped off and only "012345678" is printed.

Plus I threw in one small related cleanup.

Signed-off-by: Dan Carpenter 
Signed-off-by: Nicholas Bellinger

target: Fix transport_get_lun_for_tmr failure cases

2011-06-23T23:59:45+00:00

This patch fixes two possible NULL pointer dereferences in target v4.0
code where se_tmr release path in core_tmr_release_req() can OOPs upon
transport_get_lun_for_tmr() failure by attempting to access se_device or
se_tmr->tmr_list without a valid member of se_device->tmr_list during
transport_free_se_cmd() release.  This patch moves the se_tmr->tmr_dev
pointer assignment in transport_get_lun_for_tmr() until after possible
-ENODEV failures during unpacked_lun lookup.

This addresses an OOPs originally reported with LIO v4.1 upstream on
.39 code here:

    TARGET_CORE[qla2xxx]: Detected NON_EXISTENT_LUN Access for 0x00000000
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000550
    IP: [] __ticket_spin_trylock+0x4/0x20
    PGD 0
    Oops: 0000 [#1] SMP
    last sysfs file: /sys/devices/system/cpu/cpu23/cache/index2/shared_cpu_map
    CPU 1
    Modules linked in: netconsole target_core_pscsi target_core_file
tcm_qla2xxx target_core_iblock tcm_loop target_core_mod configfs
ipmi_devintf ipmi_si ipmi_msghandler serio_raw i7core_edac ioatdma dca
edac_core ps_bdrv ses enclosure usbhid usb_storage ahci qla2xxx hid
uas e1000e mpt2sas libahci mlx4_core scsi_transport_fc
scsi_transport_sas raid_class scsi_tgt [last unloaded: netconsole]

    Pid: 0, comm: kworker/0:0 Tainted: G        W   2.6.39+ #1 Xyratex Storage Server
    RIP: 0010:[] []__ticket_spin_trylock+0x4/0x20
    RSP: 0018:ffff88063e803c08  EFLAGS: 00010286
    RAX: ffff880619ab45e0 RBX: 0000000000000550 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000550
    RBP: ffff88063e803c08 R08: 0000000000000002 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000568
    R13: 0000000000000001 R14: 0000000000000000 R15: ffff88060cd96a20
    FS:  0000000000000000(0000) GS:ffff88063e800000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000550 CR3: 0000000001a03000 CR4: 00000000000006e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process kworker/0:0 (pid: 0, threadinfo ffff880619ab8000, task ffff880619ab45e0)
    Stack:
     ffff88063e803c28 ffffffff812cf039 0000000000000550 0000000000000568
     ffff88063e803c58 ffffffff8157071e ffffffffa028a1dc ffff88060f7e4600
     0000000000000550 ffff880616961480 ffff88063e803c78 ffffffffa028a1dc
    Call Trace:

     [] do_raw_spin_trylock+0x19/0x50
     [] _raw_spin_lock+0x3e/0x70
     [] ? core_tmr_release_req+0x2c/0x60 [target_core_mod]
     [] core_tmr_release_req+0x2c/0x60 [target_core_mod]
     [] transport_free_se_cmd+0x22/0x50 [target_core_mod]
     [] transport_release_cmd_to_pool+0x20/0x40 [target_core_mod]
     [] transport_generic_free_cmd+0xa5/0xb0 [target_core_mod]
     [] tcm_qla2xxx_handle_tmr+0xc4/0xd0 [tcm_qla2xxx]
     [] __qla24xx_handle_abts+0xd3/0x150 [qla2xxx]
     [] qla_tgt_response_pkt+0x171/0x520 [qla2xxx]
     [] qla_tgt_response_pkt_all_vps+0x2d/0x220 [qla2xxx]
     [] qla24xx_process_response_queue+0x1a3/0x670 [qla2xxx]
     [] ? qla24xx_atio_pkt+0x81/0x120 [qla2xxx]
     [] ? qla24xx_msix_default+0x45/0x2a0 [qla2xxx]
     [] qla24xx_msix_default+0x1b8/0x2a0 [qla2xxx]
     [] handle_irq_event_percpu+0x54/0x210
     [] handle_irq_event+0x48/0x70
     [] ? handle_edge_irq+0x1e/0x110
     [] handle_edge_irq+0x77/0x110
     [] handle_irq+0x22/0x40
     [] do_IRQ+0x5d/0xe0
     [] common_interrupt+0x13/0x13

     [] ? intel_idle+0xd7/0x130
     [] ? intel_idle+0xd0/0x130
     [] cpuidle_idle_call+0xab/0x1c0
     [] cpu_idle+0xab/0xf0
     [] start_secondary+0x1cb/0x1d2

Reported-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger

[SCSI] target: Convert REPORT_LUNs to use int_to_scsilun

2011-05-27T11:49:43+00:00

This patch converts transport_core_report_lun_response() to use
drivers/scsi/scsi_scan.c:int_to_scsilun instead of using the
struct target_core_fabric_ops->pack_lun() fabric provided API vector.

It also removes the tfo->pack_lun check from target_fabric_tf_ops_check()
and removes from struct target_core_fabric_ops->pack_lun() from
target_core_fabric_ops.h, and the following mainline scsi-misc fabric
modules:

*) tcm_loop: Drop tcm_loop_pack_lun() usage
*) tcm_fc: Drop ft_pack_lun() usage

Reported-by: Mike Christie 
Signed-off-by: Nicholas A. Bellinger 
Signed-off-by: James Bottomley

[SCSI] target: Fix interrupt context bug with stats_lock and core_tmr_alloc_req

2011-05-27T11:49:25+00:00

This patch fixes two bugs wrt to the interrupt context usage of target
core with HW target mode drivers.  It first converts the usage of struct
se_device->stats_lock in transport_get_lun_for_cmd() and core_tmr_lun_reset()
to properly use spin_lock_irq() to address an BUG with CONFIG_LOCKDEP_SUPPORT=y
enabled.

This patch also adds a 'in_interrupt()' check to allow GFP_ATOMIC usage from
core_tmr_alloc_req() to fix a 'sleeping in interrupt context' BUG with HW
target fabrics that require this logic to function.

Signed-off-by: Nicholas Bellinger 
Cc: stable@kernel.org
Signed-off-by: James Bottomley

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi

[SCSI] target: Minor sparse warning fixes and annotations

2011-03-23T16:36:29+00:00

This patch addresses the majority of sparse warnings and adds
proper locking annotations.  It also fixes the dubious one-bit signed
bitfield, for which the signed one-bit types can be 0 or -1 which can
cause a problem if someone ever checks if (foo->lu_gp_assoc == 1).
The current code is fine because everyone just checks zero vs non-zero.
But Sparse complains about it so lets change it.  The warnings look like
this:

include/target/target_core_base.h:228:26: error: dubious one-bit signed bitfield

Signed-off-by: Dan Carpenter 
Signed-off-by: Fubo Chen 
Signed-off-by: Nicholas A. Bellinger 
Signed-off-by: James Bottomley

[SCSI] target: Remove unnecessary hba_dev_list walk and se_clear_dev_ports legacy code

2011-03-23T16:36:27+00:00

This patch removes a legacy struct se_hba->hba_dev_list -> se_release_device_for_hba()
list walk in core_delete_hba(), which is no longer required while using configfs
VFS level parent/child struct config_group dependency referencing.  The reason
is because any struct se_hba->hba_dev_list-> struct se_device members are going
to have to be released via:

	rmdir /sys/kernel/config/target/core/$HBA/*

before rmdir release of struct se_hba via target_core_configfs.c:
target_core_call_delhbafromtarget() -> core_delete_hba()

	rmdir /sys/kernel/config/target/core/$HBA

to release struct se_hba in core_delete_hba().

This patch also removes the legacy se_clear_dev_ports() function, which is
left-over pre-configfs shutdown logic for when se_free_virtual_device()
was responsible for walking struct se_device->dev_sep_list and calling
core_dev_del_lun() for each individual active struct se_port->se_lun.

The reason this can be removed is because all struct se_device->dev_sep_list
-> struct se_port communication is done via configfs symlinks, which
means that an target fabric module's endpoints containg active struct
se_port(s) will have to be released via target_core_fabric_configfs.c:
target_fabric_port_unlink() via:

	unlink /sys/kernel/config/target/$FABRIC_MOD/$ENDPOINT/tpgt_$TPGT/lun/lun_$LUN_ID/

before rmdir release of struct se_device in target_core_configfs.c:
target_core_drop_subdev() -> se_free_virtual_device() can happen via:

	rmdir /sys/kernel/config/target/core/$HBA/*

to release struct se_subsystem_dev in target_core_drop_subdev()

Reported-by: Stefan Richter 
Reported-by: Fubo Chen 
Signed-off-by: Nicholas A. Bellinger 
Signed-off-by: James Bottomley

drivers: remove extraneous includes of smp_lock.h

2011-03-01T23:02:40+00:00

These were missed the last time I cleaned this up
globally, because of code moving around or new code
getting merged.

Signed-off-by: Arnd Bergmann

[SCSI] target: Remove procfs based target_core_mib.c code

2011-02-12T18:15:47+00:00

This patch removes the legacy procfs based target_core_mib.c code,
and moves the necessary scsi_index_tables functions and defines into
target_core_transport.c and target_core_base.h code to allow existing
fabric independent statistics to function.

This includes the removal of a handful of 'atomic_t mib_ref_count'
counters used in struct se_node_acl, se_session and se_hba to prevent
removal while using seq_list procfs walking logic.

[jejb: fix up compile failures]
Signed-off-by: Nicholas A. Bellinger 
Signed-off-by: James Bottomley

[SCSI] target: fixed missing lock drop in error path

2011-02-12T17:38:17+00:00

The struct se_node_acl->device_list_lock needs to be released if either
sanity check for struct se_dev_entry->se_lun_acl or deve->se_lun fails.

Signed-off-by: Fubo Chen 
Signed-off-by: Nicholas A. Bellinger 
Signed-off-by: James Bottomley