linux-toradex.git/drivers/target/target_core_tmr.c, branch v3.0.21

target: Fix transport_get_lun_for_tmr failure cases

2011-06-23T23:59:45+00:00

This patch fixes two possible NULL pointer dereferences in target v4.0
code where se_tmr release path in core_tmr_release_req() can OOPs upon
transport_get_lun_for_tmr() failure by attempting to access se_device or
se_tmr->tmr_list without a valid member of se_device->tmr_list during
transport_free_se_cmd() release.  This patch moves the se_tmr->tmr_dev
pointer assignment in transport_get_lun_for_tmr() until after possible
-ENODEV failures during unpacked_lun lookup.

This addresses an OOPs originally reported with LIO v4.1 upstream on
.39 code here:

    TARGET_CORE[qla2xxx]: Detected NON_EXISTENT_LUN Access for 0x00000000
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000550
    IP: [] __ticket_spin_trylock+0x4/0x20
    PGD 0
    Oops: 0000 [#1] SMP
    last sysfs file: /sys/devices/system/cpu/cpu23/cache/index2/shared_cpu_map
    CPU 1
    Modules linked in: netconsole target_core_pscsi target_core_file
tcm_qla2xxx target_core_iblock tcm_loop target_core_mod configfs
ipmi_devintf ipmi_si ipmi_msghandler serio_raw i7core_edac ioatdma dca
edac_core ps_bdrv ses enclosure usbhid usb_storage ahci qla2xxx hid
uas e1000e mpt2sas libahci mlx4_core scsi_transport_fc
scsi_transport_sas raid_class scsi_tgt [last unloaded: netconsole]

    Pid: 0, comm: kworker/0:0 Tainted: G        W   2.6.39+ #1 Xyratex Storage Server
    RIP: 0010:[] []__ticket_spin_trylock+0x4/0x20
    RSP: 0018:ffff88063e803c08  EFLAGS: 00010286
    RAX: ffff880619ab45e0 RBX: 0000000000000550 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000550
    RBP: ffff88063e803c08 R08: 0000000000000002 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000568
    R13: 0000000000000001 R14: 0000000000000000 R15: ffff88060cd96a20
    FS:  0000000000000000(0000) GS:ffff88063e800000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000550 CR3: 0000000001a03000 CR4: 00000000000006e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process kworker/0:0 (pid: 0, threadinfo ffff880619ab8000, task ffff880619ab45e0)
    Stack:
     ffff88063e803c28 ffffffff812cf039 0000000000000550 0000000000000568
     ffff88063e803c58 ffffffff8157071e ffffffffa028a1dc ffff88060f7e4600
     0000000000000550 ffff880616961480 ffff88063e803c78 ffffffffa028a1dc
    Call Trace:

     [] do_raw_spin_trylock+0x19/0x50
     [] _raw_spin_lock+0x3e/0x70
     [] ? core_tmr_release_req+0x2c/0x60 [target_core_mod]
     [] core_tmr_release_req+0x2c/0x60 [target_core_mod]
     [] transport_free_se_cmd+0x22/0x50 [target_core_mod]
     [] transport_release_cmd_to_pool+0x20/0x40 [target_core_mod]
     [] transport_generic_free_cmd+0xa5/0xb0 [target_core_mod]
     [] tcm_qla2xxx_handle_tmr+0xc4/0xd0 [tcm_qla2xxx]
     [] __qla24xx_handle_abts+0xd3/0x150 [qla2xxx]
     [] qla_tgt_response_pkt+0x171/0x520 [qla2xxx]
     [] qla_tgt_response_pkt_all_vps+0x2d/0x220 [qla2xxx]
     [] qla24xx_process_response_queue+0x1a3/0x670 [qla2xxx]
     [] ? qla24xx_atio_pkt+0x81/0x120 [qla2xxx]
     [] ? qla24xx_msix_default+0x45/0x2a0 [qla2xxx]
     [] qla24xx_msix_default+0x1b8/0x2a0 [qla2xxx]
     [] handle_irq_event_percpu+0x54/0x210
     [] handle_irq_event+0x48/0x70
     [] ? handle_edge_irq+0x1e/0x110
     [] handle_edge_irq+0x77/0x110
     [] handle_irq+0x22/0x40
     [] do_IRQ+0x5d/0xe0
     [] common_interrupt+0x13/0x13

     [] ? intel_idle+0xd7/0x130
     [] ? intel_idle+0xd0/0x130
     [] cpuidle_idle_call+0xab/0x1c0
     [] cpu_idle+0xab/0xf0
     [] start_secondary+0x1cb/0x1d2

Reported-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger

[SCSI] target: Fix interrupt context bug with stats_lock and core_tmr_alloc_req

2011-05-27T11:49:25+00:00

This patch fixes two bugs wrt to the interrupt context usage of target
core with HW target mode drivers.  It first converts the usage of struct
se_device->stats_lock in transport_get_lun_for_cmd() and core_tmr_lun_reset()
to properly use spin_lock_irq() to address an BUG with CONFIG_LOCKDEP_SUPPORT=y
enabled.

This patch also adds a 'in_interrupt()' check to allow GFP_ATOMIC usage from
core_tmr_alloc_req() to fix a 'sleeping in interrupt context' BUG with HW
target fabrics that require this logic to function.

Signed-off-by: Nicholas Bellinger 
Cc: stable@kernel.org
Signed-off-by: James Bottomley

[SCSI] target: Fix t_transport_aborted handling in LUN_RESET + active I/O shutdown

2011-02-28T17:23:32+00:00

This patch addresses two outstanding bugs related to
T_TASK(cmd)->t_transport_aborted handling during TMR LUN_RESET and
active I/O shutdown.

This first involves adding two explict t_transport_aborted=1
assignments in core_tmr_lun_reset() in order to signal the task has
been aborted, and updating transport_generic_wait_for_tasks() to skip
sleeping when t_transport_aborted=1 has been set.  This fixes an issue
where transport_generic_wait_for_tasks() would end up sleeping
indefinately when called from fabric module context while TMR
LUN_RESET was happening with long outstanding backend struct se_task
not yet being completed.

The second adds a missing call to
transport_remove_task_from_execute_queue() when
task->task_execute_queue=1 is set in order to fix an OOPs when
task->t_execute_list has not been dropped.  It also fixes the same
case in transport_processing_shutdown() to prevent the issue from
happening during active I/O struct se_device shutdown.

Signed-off-by: Nicholas A. Bellinger 
Signed-off-by: James Bottomley

[SCSI] target: Add LIO target core v4.0.0-rc6

2011-01-14T16:12:29+00:00

LIO target is a full featured in-kernel target framework with the
following feature set:

High-performance, non-blocking, multithreaded architecture with SIMD
support.

Advanced SCSI feature set:

    * Persistent Reservations (PRs)
    * Asymmetric Logical Unit Assignment (ALUA)
    * Protocol and intra-nexus multiplexing, load-balancing and failover (MC/S)
    * Full Error Recovery (ERL=0,1,2)
    * Active/active task migration and session continuation (ERL=2)
    * Thin LUN provisioning (UNMAP and WRITE_SAMExx)

Multiprotocol target plugins

Storage media independence:

    * Virtualization of all storage media; transparent mapping of IO to LUNs
    * No hard limits on number of LUNs per Target; maximum LUN size ~750 TB
    * Backstores: SATA, SAS, SCSI, BluRay, DVD, FLASH, USB, ramdisk, etc.

Standards compliance:

    * Full compliance with IETF (RFC 3720)
    * Full implementation of SPC-4 PRs and ALUA

Significant code cleanups done by Christoph Hellwig.

[jejb: fix up for new block bdev exclusive interface. Minor fixes from
 Randy Dunlap and Dan Carpenter.]
Signed-off-by: Nicholas A. Bellinger 
Signed-off-by: James Bottomley