linux-toradex.git/drivers/target, branch v3.18.21

iscsi-target: Fix iscsit_start_kthreads failure OOPs

2015-08-27T17:25:53+00:00

[ Upstream commit e54198657b65625085834847ab6271087323ffea ]

This patch fixes a regression introduced with the following commit
in v4.0-rc1 code, where a iscsit_start_kthreads() failure triggers
a NULL pointer dereference OOPs:

    commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca
    Author: Nicholas Bellinger 
    Date:   Thu Feb 26 22:19:15 2015 -0800

        iscsi-target: Convert iscsi_thread_set usage to kthread.h

To address this bug, move iscsit_start_kthreads() immediately
preceeding the transmit of last login response, before signaling
a successful transition into full-feature-phase within existing
iscsi_target_do_tx_login_io() logic.

This ensures that no target-side resource allocation failures can
occur after the final login response has been successfully sent.

Also, it adds a iscsi_conn->rx_login_comp to allow the RX thread
to sleep to prevent other socket related failures until the final
iscsi_post_login_handler() call is able to complete.

Cc: Sagi Grimberg 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi-target: Fix iser explicit logout TX kthread leak

2015-08-27T17:25:52+00:00

[ Upstream commit 007d038bdf95ccfe2491d0078be54040d110fd06 ]

This patch fixes a regression introduced with the following commit
in v4.0-rc1 code, where an explicit iser-target logout would result
in ->tx_thread_active being incorrectly cleared by the logout post
handler, and subsequent TX kthread leak:

    commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca
    Author: Nicholas Bellinger 
    Date:   Thu Feb 26 22:19:15 2015 -0800

        iscsi-target: Convert iscsi_thread_set usage to kthread.h

To address this bug, change iscsit_logout_post_handler_closesession()
and iscsit_logout_post_handler_samecid() to only cmpxchg() on
->tx_thread_active for traditional iscsi/tcp connections.

This is required because iscsi/tcp connections are invoking logout
post handler logic directly from TX kthread context, while iser
connections are invoking logout post handler logic from a seperate
workqueue context.

Cc: Sagi Grimberg 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi-target: Fix use-after-free during TPG session shutdown

2015-08-27T17:25:51+00:00

[ Upstream commit 417c20a9bdd1e876384127cf096d8ae8b559066c ]

This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
where se_portal_group->session_lock was incorrectly released/re-acquired
while walking the active se_portal_group->tpg_sess_list.

The can result in a NULL pointer dereference when iscsit_close_session()
shutdown happens in the normal path asynchronously to this code, causing
a bogus dereference of an already freed list entry to occur.

To address this bug, walk the session list checking for the same state
as before, but move entries to a local list to avoid dropping the lock
while walking the active list.

As before, signal using iscsi_session->session_restatement=1 for those
list entries to be released locally by iscsit_free_session() code.

Reported-by: Sunilkumar Nadumuttlu 
Cc: Sunilkumar Nadumuttlu 
Cc:  # v3.1+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi-target: Convert iscsi_thread_set usage to kthread.h

2015-08-04T18:34:17+00:00

[ Upstream commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca ]

This patch converts iscsi-target code to use modern kthread.h API
callers for creating RX/TX threads for each new iscsi_conn descriptor,
and releasing associated RX/TX threads during connection shutdown.

This is done using iscsit_start_kthreads() -> kthread_run() to start
new kthreads from within iscsi_post_login_handler(), and invoking
kthread_stop() from existing iscsit_close_connection() code.

Also, convert iscsit_logout_post_handler_closesession() code to use
cmpxchg when determing when iscsit_cause_connection_reinstatement()
needs to sleep waiting for completion.

Reported-by: Sagi Grimberg 
Tested-by: Sagi Grimberg 
Cc: Slava Shwartsman 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST

2015-06-10T17:42:15+00:00

[ Upstream commit 5a7125c64def3b21f8147eca8b54949a60963942 ]

See https://bugzilla.redhat.com/show_bug.cgi?id=1025672

We need to put() the reference to the scsi host that we got in
pscsi_configure_device(). In VIRTUAL_HOST mode it is associated with
the dev_virt, not the hba_virt.

Signed-off-by: Andy Grover 
Cc: stable@vger.kernel.org # 2.6.38+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target/file: Fix SG table for prot_buf initialization

2015-05-17T23:12:12+00:00

[ Upstream commit c836777830428372074d5129ac513e1472c99791 ]

In fd_do_prot_rw(), it allocates prot_buf which is used to copy from
se_cmd->t_prot_sg by sbc_dif_copy_prot().  The SG table for prot_buf
is also initialized by allocating 'se_cmd->t_prot_nents' entries of
scatterlist and setting the data length of each entry to PAGE_SIZE
at most.

However if se_cmd->t_prot_sg contains a clustered entry (i.e.
sg->length > PAGE_SIZE), the SG table for prot_buf can't be
initialized correctly and sbc_dif_copy_prot() can't copy to prot_buf.
(This actually happened with TCM loopback fabric module)

As prot_buf is allocated by kzalloc() and it's physically contiguous,
we only need a single scatterlist entry.

Signed-off-by: Akinobu Mita 
Cc: Sagi Grimberg 
Cc: "Martin K. Petersen" 
Cc: Christoph Hellwig 
Cc: "James E.J. Bottomley" 
Cc:  # v3.14+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target/file: Fix UNMAP with DIF protection support

2015-05-17T23:12:12+00:00

[ Upstream commit 64d240b721b21e266ffde645ec965c3b6d1c551f ]

When UNMAP command is issued with DIF protection support enabled,
the protection info for the unmapped region is remain unchanged.
So READ command for the region causes data integrity failure.

This fixes it by invalidating protection info for the unmapped region
by filling with 0xff pattern.  This change also adds helper function
fd_do_prot_fill() in order to reduce code duplication with existing
fd_format_prot().

Signed-off-by: Akinobu Mita 
Reviewed-by: Sagi Grimberg 
Reviewed-by: "Martin K. Petersen" 
Cc: Christoph Hellwig 
Cc: "James E.J. Bottomley" 
Cc:  # v3.14+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target/file: Fix BUG() when CONFIG_DEBUG_SG=y and DIF protection enabled

2015-05-17T23:12:11+00:00

[ Upstream commit 38da0f49e8aa1649af397d53f88e163d0e60c058 ]

When CONFIG_DEBUG_SG=y and DIF protection support enabled, kernel
BUG()s are triggered due to the following two issues:

1) prot_sg is not initialized by sg_init_table().

When CONFIG_DEBUG_SG=y, scatterlist helpers check sg entry has a
correct magic value.

2) vmalloc'ed buffer is passed to sg_set_buf().

sg_set_buf() uses virt_to_page() to convert virtual address to struct
page, but it doesn't work with vmalloc address.  vmalloc_to_page()
should be used instead.  As prot_buf isn't usually too large, so
fix it by allocating prot_buf by kmalloc instead of vmalloc.

Signed-off-by: Akinobu Mita 
Cc: Sagi Grimberg 
Cc: "Martin K. Petersen" 
Cc: Christoph Hellwig 
Cc: "James E.J. Bottomley" 
Cc:  # v3.14+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

target: Fix COMPARE_AND_WRITE with SG_TO_MEM_NOALLOC handling

2015-05-17T23:12:11+00:00

[ Upstream commit c8e639852ad720499912acedfd6b072325fd2807 ]

This patch fixes a bug for COMPARE_AND_WRITE handling with
fabrics using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC.

It adds the missing allocation for cmd->t_bidi_data_sg within
transport_generic_new_cmd() that is used by COMPARE_AND_WRITE
for the initial READ payload, even if the fabric is already
providing a pre-allocated buffer for cmd->t_data_sg.

Also, fix zero-length COMPARE_AND_WRITE handling within the
compare_and_write_callback() and target_complete_ok_work()
to queue the response, skipping the initial READ.

This fixes COMPARE_AND_WRITE emulation with loopback, vhost,
and xen-backend fabric drivers using SG_TO_MEM_NOALLOC.

Reported-by: Christoph Hellwig 
Cc: Christoph Hellwig 
Cc:  # v3.12+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iscsi target: fix oops when adding reject pdu

2015-04-24T21:14:07+00:00

[ Upstream commit b815fc12d4dd2b5586184fb4f867caff05a810d4 ]

This fixes a oops due to a double list add when adding a reject PDU for
iscsit_allocate_iovecs allocation failures. The cmd has already been
added to the conn_cmd_list in iscsit_setup_scsi_cmd, so this has us call
iscsit_reject_cmd.

Note that for ERL0 the reject PDU is not actually sent, so this patch
is not completely tested. Just verified we do not oops. The problem is the
add reject functions return -1 which is returned all the way up to
iscsi_target_rx_thread which for ERL0 will drop the connection.

Signed-off-by: Mike Christie 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin