linux-toradex.git/drivers/target/tcm_fc, branch v3.2.68

target/tcm_fc: Fix use-after-free of ft_tpg

2014-04-30T15:23:26+00:00

commit 2c42be2dd4f6586728dba5c4e197afd5cfaded78 upstream.

ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
tport when the tpg is being removed. Set this pointer in ft_tport_create,
or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
a deleted object.

This patch sets tpg->tport in ft_tport_create, because that's what
ft_del_tpg checks, and is the only way to get back to the tport to
clear tport->tpg.

The bug was occuring when:

- lport created, tport (our per-lport, per-provider context) is
  allocated.
  tport->tpg = NULL
- tpg created
- a PRLI is received. ft_tport_create is called, tpg is found and
  tport->tpg is set
- tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
  set, tport->tpg is not cleared and points at freed memory
- Future calls to ft_tport_create return tport via first conditional,
  instead of searching for new tpg by calling ft_lport_find_tpg.
  tport->tpg is still invalid, and will access freed memory.

see https://bugzilla.redhat.com/show_bug.cgi?id=1071340

Signed-off-by: Andy Grover 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings

tcm_fc: Do not report target role when target is not defined

2013-02-06T04:33:29+00:00

commit edec8dfefa1f372b2dd8197da555352e76a10c03 upstream.

Clear the target role when no target is provided for
the node performing a PRLI.

Signed-off-by: Mark Rustad 
Reviewed-by: Bhanu Prakash Gollapudi 
Acked by Robert Love 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings

tcm_fc: Do not indicate retry capability to initiators

2013-02-06T04:33:28+00:00

commit f2eeba214bcd0215b7f558cab6420e5fd153042b upstream.

When generating a PRLI response to an initiator, clear the
FCP_SPPF_RETRY bit in the response.

Signed-off-by: Mark Rustad 
Reviewed-by: Bhanu Prakash Gollapudi 
Acked by Robert Love 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings

target/tcm_fc: fix the lockdep warning due to inconsistent lock state

2013-01-03T03:33:38+00:00

commit 9f4ad44b264f8bb61ffdd607148215566568430d upstream.

The lockdep warning below is in theory correct but it will be in really weird
rare situation that ends up that deadlock since the tcm fc session is hashed
based the rport id. Nonetheless, the complaining below is about rcu callback
that does the transport_deregister_session() is happening in softirq, where
transport_register_session() that happens earlier is not. This triggers the
lockdep warning below. So, just fix this to make lockdep happy by disabling
the soft irq before calling transport_register_session() in ft_prli.

BTW, this was found in FCoE VN2VN over two VMs, couple of create and destroy
would get this triggered.

v1: was enforcing register to be in softirq context which was not righ. See,
http://www.spinics.net/lists/target-devel/msg03614.html

v2: following comments from Roland&Nick (thanks), it seems we don't have to
do transport_deregister_session() in rcu callback, so move it into ft_sess_free()
but still do kfree() of the corresponding ft_sess struct in rcu callback to
make sure the ft_sess is not freed till the rcu callback.

...
[ 1328.370592] scsi2 : FCoE Driver
[ 1328.383429] fcoe: No FDMI support.
[ 1328.384509] host2: libfc: Link up on port (000000)
[ 1328.934229] host2: Assigned Port ID 00a292
[ 1357.232132] host2: rport 00a393: Remove port
[ 1357.232568] host2: rport 00a393: Port sending LOGO from Ready state
[ 1357.233692] host2: rport 00a393: Delete port
[ 1357.234472] host2: rport 00a393: work event 3
[ 1357.234969] host2: rport 00a393: callback ev 3
[ 1357.235979] host2: rport 00a393: Received a LOGO response closed
[ 1357.236706] host2: rport 00a393: work delete
[ 1357.237481]
[ 1357.237631] =================================
[ 1357.238064] [ INFO: inconsistent lock state ]
[ 1357.238450] 3.7.0-rc7-yikvm+ #3 Tainted: G           O
[ 1357.238450] ---------------------------------
[ 1357.238450] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[ 1357.238450] ksoftirqd/0/3 [HC0[0]:SC1[1]:HE0:SE0] takes:
[ 1357.238450]  (&(&se_tpg->session_lock)->rlock){+.?...}, at: [] transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450] {SOFTIRQ-ON-W} state was registered at:
[ 1357.238450]   [] mark_held_locks+0x6d/0x95
[ 1357.238450]   [] trace_hardirqs_on_caller+0x12d/0x197
[ 1357.238450]   [] trace_hardirqs_on+0xd/0xf
[ 1357.238450]   [] _raw_spin_unlock_irq+0x2d/0x45
[ 1357.238450]   [] __transport_register_session+0xb8/0x122 [target_core_mod]
[ 1357.238450]   [] transport_register_session+0x44/0x5a [target_core_mod]
[ 1357.238450]   [] ft_prli+0x1e3/0x275 [tcm_fc]
[ 1357.238450]   [] fc_rport_recv_req+0x95e/0xdc5 [libfc]
[ 1357.238450]   [] fc_lport_recv_els_req+0xc4/0xd5 [libfc]
[ 1357.238450]   [] fc_lport_recv_req+0x12f/0x18f [libfc]
[ 1357.238450]   [] fc_exch_recv+0x8ba/0x981 [libfc]
[ 1357.238450]   [] fcoe_percpu_receive_thread+0x47a/0x4e2 [fcoe]
[ 1357.238450]   [] kthread+0xb1/0xb9
[ 1357.238450]   [] ret_from_fork+0x7c/0xb0
[ 1357.238450] irq event stamp: 275411
[ 1357.238450] hardirqs last  enabled at (275410): [] rcu_process_callbacks+0x229/0x42a
[ 1357.238450] hardirqs last disabled at (275411): [] _raw_spin_lock_irqsave+0x22/0x8e
[ 1357.238450] softirqs last  enabled at (275394): [] __do_softirq+0x246/0x26f
[ 1357.238450] softirqs last disabled at (275399): [] run_ksoftirqd+0x29/0x62
[ 1357.238450]
[ 1357.238450] other info that might help us debug this:
[ 1357.238450]  Possible unsafe locking scenario:
[ 1357.238450]
[ 1357.238450]        CPU0
[ 1357.238450]        ----
[ 1357.238450]   lock(&(&se_tpg->session_lock)->rlock);
[ 1357.238450]   
[ 1357.238450]     lock(&(&se_tpg->session_lock)->rlock);
[ 1357.238450]
[ 1357.238450]  *** DEADLOCK ***
[ 1357.238450]
[ 1357.238450] no locks held by ksoftirqd/0/3.
[ 1357.238450]
[ 1357.238450] stack backtrace:
[ 1357.238450] Pid: 3, comm: ksoftirqd/0 Tainted: G           O 3.7.0-rc7-yikvm+ #3
[ 1357.238450] Call Trace:
[ 1357.238450]  [] print_usage_bug+0x1f5/0x206
[ 1357.238450]  [] ? save_stack_trace+0x2c/0x49
[ 1357.238450]  [] ? print_irq_inversion_bug.part.14+0x1ae/0x1ae
[ 1357.238450]  [] mark_lock+0x106/0x258
[ 1357.238450]  [] __lock_acquire+0x2e7/0xe53
[ 1357.238450]  [] ? pvclock_clocksource_read+0x48/0xb4
[ 1357.238450]  [] ? rcu_process_gp_end+0xc0/0xc9
[ 1357.238450]  [] ? transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450]  [] lock_acquire+0x119/0x143
[ 1357.238450]  [] ? transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450]  [] _raw_spin_lock_irqsave+0x54/0x8e
[ 1357.238450]  [] ? transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450]  [] transport_deregister_session+0x41/0x148 [target_core_mod]
[ 1357.238450]  [] ? rcu_process_callbacks+0x229/0x42a
[ 1357.238450]  [] ft_sess_rcu_free+0x17/0x24 [tcm_fc]
[ 1357.238450]  [] ? ft_sess_free+0x1b/0x1b [tcm_fc]
[ 1357.238450]  [] rcu_process_callbacks+0x260/0x42a
[ 1357.238450]  [] __do_softirq+0x13a/0x26f
[ 1357.238450]  [] ? __schedule+0x65f/0x68e
[ 1357.238450]  [] run_ksoftirqd+0x29/0x62
[ 1357.238450]  [] smpboot_thread_fn+0x1a5/0x1aa
[ 1357.238450]  [] ? smpboot_unregister_percpu_thread+0x47/0x47
[ 1357.238450]  [] kthread+0xb1/0xb9
[ 1357.238450]  [] ? wait_for_common+0xbb/0x10a
[ 1357.238450]  [] ? __init_kthread_worker+0x59/0x59
[ 1357.238450]  [] ret_from_fork+0x7c/0xb0
[ 1357.238450]  [] ? __init_kthread_worker+0x59/0x59
[ 1417.440099]  rport-2:0-0: blocked FC remote port time out: removing rport

Signed-off-by: Yi Zou 
Cc: Open-FCoE 
Cc: Nicholas A. Bellinger 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings

tcm_fc: Fix crash seen with aborts and large reads

2012-07-25T03:11:24+00:00

commit 3cc5d2a6b9a2fd1bf024aa5e52dd22961eecaf13 upstream.

This patch fixes a crash seen when large reads have their exchange
aborted by either timing out or being reset. Because the exchange
abort results in the seq pointer being set to NULL, because the
sequence is no longer valid, it must not be dereferenced. This
patch changes the function ft_get_task_tag to return ~0 if it is
unable to get the tag for this reason. Because the get_task_tag
interface provides no means of returning an error, this seems
like the best way to fix this issue at the moment.

Signed-off-by: Mark Rustad 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings

tcm_fc: Resolve suspicious RCU usage warnings

2012-07-12T03:32:19+00:00

commit 863555be0c81558b1af277addcf68acb8f778860 upstream.

Use rcu_dereference_protected to tell rcu that the ft_lport_lock
is held during ft_lport_create. This resolved "suspicious RCU usage"
warnings when debugging options are turned on.

Signed-off-by: Mark Rustad 
Tested-by: Ross Brattain 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings

tcm_fc: Do not free tpg structure during wq allocation failure

2012-04-13T15:33:49+00:00

commit 06383f10c49f507220594a455c6491ca6f8c94ab upstream.

Avoid freeing a registered tpg structure if an alloc_workqueue call
fails.  This fixes a bug where the failure was leaking memory associated
with se_portal_group setup during the original core_tpg_register() call.

Signed-off-by: Mark Rustad 
Acked-by: Kiran Patil 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

tcm_fc: Add abort flag for gracefully handling exchange timeout

2012-04-13T15:33:49+00:00

commit e1c4038282c7586c3544542b37872c434669d3ac upstream.

Add abort flag and use it to terminate processing when an exchange
is timed out or is reset. The abort flag is used in place of the
transport_generic_free_cmd function call in the reset and timeout
cases, because calling that function in that context would free
memory that was in use. The aborted flag allows the lifetime to
be managed in a more normal way, while truncating the processing.

This change eliminates a source of memory corruption which
manifested in a variety of ugly ways.

(nab: Drop unused struct fc_exch *ep in ft_recv_seq)

Signed-off-by: Mark Rustad 
Acked-by: Kiran Patil 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

tcm_fc: Fix fc_exch memory leak in ft_send_resp_status

2012-04-02T16:52:45+00:00

commit 031ed4d565b31880a4136bb7366bc89f5b1dba7d upstream.

This patch fixes a bug in tcm_fc where fc_exch memory from fc_exch_mgr->ep_pool
is currently being leaked by ft_send_resp_status() usage.  Following current
code in ft_queue_status() response path, using lport->tt.seq_send() needs to be
followed by a lport->tt.exch_done() in order to release fc_exch memory back into
libfc_em kmem_cache.

ft_send_resp_status() code is currently used in pre submit se_cmd ft_send_work()
error exceptions, TM request setup exceptions, and main TM response callback
path in ft_queue_tm_resp().  This bugfix addresses the leak in these cases.

Cc: Mark D Rustad 
Cc: Kiran Patil 
Cc: Robert Love 
Cc: Andy Grover 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Drop config_item_name usage in fabric TFO->free_wwn()

2011-12-06T06:00:51+00:00

This patch removes config_item_name() informational usage of
TFO->free_wwn() treewide in loopback, tcm_fc, ib_srpt and
tcm_vhost module code.

Using v4 target_core_fabric_configfs.c logic, a fabric call for
config_item_name() in TFO->drop_wwn() context returns NULL as
target_fabric_drop_wwn() invoking config_item_put() ->
config_group_put() will release fabric_port->port_wwn.wwn_group
before the last config_item_put() -> TFO->drop_wwn() is
invoked.

Reported-by: Bart Van Assche 
Signed-off-by: Nicholas Bellinger