linux.git/drivers/target, branch v6.4-rc2

scsi: target: core: Fix invalid memory access

2023-04-12T00:49:43+00:00

nr_attrs should start counting from zero, otherwise we will end up
dereferencing an invalid memory address.

$ targetcli /loopback create

 general protection fault
 RIP: 0010:configfs_create_file+0x12/0x70
 Call Trace:
  
  configfs_attach_item.part.0+0x5f/0x150
  configfs_attach_group.isra.0+0x49/0x120
  configfs_mkdir+0x24f/0x4d0
  vfs_mkdir+0x192/0x240
  do_mkdirat+0x131/0x160
  __x64_sys_mkdir+0x48/0x70
  do_syscall_64+0x5c/0x90

Fixes: 31177b74790c ("scsi: target: core: Add RTPI attribute for target port")
Signed-off-by: Maurizio Lombardi 
Link: https://lore.kernel.org/r/20230407130033.556644-1-mlombard@redhat.com
Acked-by: Dmitry Bogdanov 
Reviewed-by: Mike Christie 
Signed-off-by: Martin K. Petersen

scsi: target: core: Remove unused 'prod_len' variable

2023-04-03T01:35:52+00:00

clang with W=1 reports:

drivers/target/target_core_spc.c:229:6: error: variable
  'prod_len' set but not used [-Werror,-Wunused-but-set-variable]
        u32 prod_len;
            ^
This variable is not used so remove it.

Signed-off-by: Tom Rix 
Link: https://lore.kernel.org/r/20230329132421.1809362-1-trix@redhat.com
Reviewed-by: Chaitanya Kulkarni 
Signed-off-by: Martin K. Petersen

Merge branch '6.3/scsi-fixes' into 6.4/scsi-staging

2023-04-01T01:45:14+00:00

Pull in the fixes branch to resolve an mpi3mr conflict reported by
sfr.

Signed-off-by: Martin K. Petersen

scsi: target: tcm_loop: Remove redundant driver match function

2023-03-25T00:44:14+00:00

If there is no driver match function, the driver core assumes that each
candidate pair (driver, device) matches. See driver_match_device().

pseudo_lld_bus_match() always returns 1 and is therefore equivalent to not
registering a match function. Remove it.

Signed-off-by: Lizhe 
Link: https://lore.kernel.org/r/20230319043518.297490-1-sensor1010@163.com
Signed-off-by: Martin K. Petersen

Merge patch series "Constify most SCSI host templates"

2023-03-25T00:13:03+00:00

Bart Van Assche  says:

It helps humans and the compiler if it is made explicit that SCSI host
templates are not modified. Hence this patch series that constifies most
SCSI host templates. Please consider this patch series for the next merge
window.

Link: https://lore.kernel.org/r/20230322195515.1267197-1-bvanassche@acm.org
Signed-off-by: Martin K. Petersen

scsi: target: tcm-loop: Declare SCSI host template const

2023-03-24T23:20:00+00:00

Make it explicit that the SCSI host template is not modified.

Signed-off-by: Bart Van Assche 
Link: https://lore.kernel.org/r/20230322195515.1267197-79-bvanassche@acm.org
Signed-off-by: Martin K. Petersen

Merge patch series "target: TMF and recovery fixes"

2023-03-24T21:39:15+00:00

Mike Christie  says:

The following patches apply over Martin's 6.4 branches and Linus's tree.
They fix a couple regressions in iscsit that occur when there are TMRs
executing and a connection is closed. It also includes Dimitry's fixes in
related code paths for cmd cleanup when ERL2 is used and the write pending
hang during conn cleanup.

This version of the patchset brings it back to just regressions and fixes
for bugs we have a lot of users hitting. I'm going to fix isert and get it
hooked into iscsit properly in a second patchset, because this one was
getting so large. I've also moved my cleanup type of patches for a 3rd
patchset.

Link: https://lore.kernel.org/r/20230319015620.96006-1-michael.christie@oracle.com
Signed-off-by: Martin K. Petersen

scsi: target: iscsi: Handle abort for WRITE_PENDING cmds

2023-03-24T21:32:23+00:00

Sometimes an initiator does not send data for a WRITE command and tries to
abort it. The abort hangs waiting for frontend driver completion. iSCSI
driver waits for data and that timeout eventually initiates connection
reinstatment. The connection closing releases the commands in the
connection, but those aborted commands still did not handle the abort and
did not decrease a command ref counter. Because of that the connection
reinstatement hangs indefinitely and prevents re-login for that initiator.

Add handling in TCM of the abort for the WRITE_PENDING commands at
connection closing moment to make it possible to release them.

Signed-off-by: Dmitry Bogdanov 
[mnc: Rebase and expand comment]
Signed-off-by: Mike Christie 
Link: https://lore.kernel.org/r/20230319015620.96006-10-michael.christie@oracle.com
Signed-off-by: Martin K. Petersen

scsi: target: iscsit: Fix TAS handling during conn cleanup

2023-03-24T21:32:23+00:00

Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort
fabric stop race").

If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the
last put on the cmd and free it, because the connection is down and we will
not up sending the response and doing the put from the normal I/O
path.

Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now
detect this case and run iscsit_free_cmd().

Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race")
Signed-off-by: Mike Christie 
Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com
Signed-off-by: Martin K. Petersen

scsi: target: Fix multiple LUN_RESET handling

2023-03-24T21:32:23+00:00

This fixes a bug where an initiator thinks a LUN_RESET has cleaned up
running commands when it hasn't. The bug was added in commit 51ec502a3266
("target: Delete tmr from list before processing").

The problem occurs when:

 1. We have N I/O cmds running in the target layer spread over 2 sessions.

 2. The initiator sends a LUN_RESET for each session.

 3. session1's LUN_RESET loops over all the running commands from both
    sessions and moves them to its local drain_task_list.

 4. session2's LUN_RESET does not see the LUN_RESET from session1 because
    the commit above has it remove itself. session2 also does not see any
    commands since the other reset moved them off the state lists.

 5. sessions2's LUN_RESET will then complete with a successful response.

 6. sessions2's inititor believes the running commands on its session are
    now cleaned up due to the successful response and cleans up the running
    commands from its side. It then restarts them.

 7. The commands do eventually complete on the backend and the target
    starts to return aborted task statuses for them. The initiator will
    either throw a invalid ITT error or might accidentally lookup a new
    task if the ITT has been reallocated already.

Fix the bug by reverting the patch, and serialize the execution of
LUN_RESETs and Preempt and Aborts.

Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list,
because it turns out the original patch fixed a bug that was not
mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second
LUN_RESET and wait on it. Then the second reset will run
core_tmr_drain_tmr_list and see the first reset and wait on it resulting in
a deadlock.

Fixes: 51ec502a3266 ("target: Delete tmr from list before processing")
Signed-off-by: Mike Christie 
Link: https://lore.kernel.org/r/20230319015620.96006-8-michael.christie@oracle.com
Signed-off-by: Martin K. Petersen