linux-toradex.git/drivers/target, branch v3.7.6

target: fix regression with dev_link_magic in target_fabric_port_link

2013-02-04T00:27:07+00:00

This is to fix a regression that only affect the stable (not for the mainline)
that the stable commit fdf9d86 was incorrectly placed dev->dev_link_magic check
before the *dev assignment in target_fabric_port_link() due to fuzzy automatically
context adjustment during the back-porting.

Reported-by: Chris Boot 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: CAI Qian 
Signed-off-by: Greg Kroah-Hartman

target: Add link_magic for fabric allow_link destination target_items

2013-01-21T19:44:44+00:00

commit 0ff8754981261a80f4b77db2536dfea92c2d4539 upstream.

This patch adds [dev,lun]_link_magic value assignment + checks within generic
target_fabric_port_link() and target_fabric_mappedlun_link() code to ensure
destination config_item *target_item sent from configfs_symlink() ->
config_item_operations->allow_link() is the underlying se_device->dev_group
and se_lun->lun_group that we expect to symlink.

Reported-by: Sebastian Andrzej Siewior 
Cc: Sebastian Andrzej Siewior 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: CAI Qian 
Signed-off-by: Greg Kroah-Hartman

target: Release se_cmd when LUN lookup fails for TMR

2013-01-21T19:44:33+00:00

commit 5a3b6fc0092c5f8dee7820064ee54d2631d48573 upstream.

When transport_lookup_tmr_lun() fails and we return a task management
response from target_complete_tmr_failure(), we need to call
transport_cmd_check_stop_to_fabric() to release the last ref to the
cmd after calling se_tfo->queue_tm_rsp(), or else we will never remove
the failed TMR from the session command list (and we'll end up waiting
forever when trying to tear down the session).

(nab: Fix minor compile breakage)

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Fix use-after-free in LUN RESET handling

2013-01-21T19:44:33+00:00

commit 72b59d6ee8adaa51f70377db0a1917ed489bead8 upstream.

If a backend IO takes a really long then an initiator might abort a
command, and then when it gives up on the abort, send a LUN reset too,
all before we process any of the original command or the abort.  (The
abort will wait for the backend IO to complete too)

When the backend IO final completes (or fails), the abort handling
will proceed and queue up a "return aborted status" operation.  Then,
while that's still pending, the LUN reset might find the original
command still on the LUN's list of commands and try to return aborted
status again, which leads to a use-after free when the first
se_tfo->queue_status call frees the command and then the second
se_tfo->queue_status call runs.

Fix this by removing a command from the LUN state_list when we first
are about to queue aborted status; we shouldn't do anything
LUN-related after we've started returning status, so this seems like
the correct thing to do.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Fix missing CMD_T_ACTIVE bit regression for pending WRITEs

2013-01-21T19:44:33+00:00

commit e627c615553a356f6f70215ebb3933c6e057553e upstream.

This patch fixes a regression bug introduced during v3.6.x code with
the following commit to drop transport_add_cmd_to_queue(), which
originally re-set CMD_T_ACTIVE during pending WRITE I/O submission:

commit af8772926f019b7bddd7477b8de5f3b0f12bad21
Author: Christoph Hellwig 
Date:   Sun Jul 8 15:58:49 2012 -0400

    target: replace the processing thread with a TMR work queue

The following sequence happens for write commands (or any other
commands with a data out phase):

 - The transport calls target_submit_cmd(), which sets CMD_T_ACTIVE in
   cmd->transport_state and sets cmd->t_state to TRANSPORT_NEW_CMD.
 - Things go on transport_generic_new_cmd(), which notices that the
   command needs to transfer data, so it sets cmd->t_state to
   TRANSPORT_WRITE_PENDING and calls transport_cmd_check_stop().
 - transport_cmd_check_stop() clears CMD_T_ACTIVE in cmd->transport_state
   and returns in the normal case.
 - Then we continue on to call ->se_tfo->write_pending().
 - The data comes back from the initiator, and the transport calls
   target_execute_cmd(), which sets cmd->t_state to TRANSPORT_PROCESSING
   and calls into the backend to actually write the data.

At this point, the backend might take a long time to complete the
command, since it has to do real IO.  If an abort request comes in for
this command at this point, it will not wait for the command to finish
since CMD_T_ACTIVE is not set.  Then when the command does finally
finish, we blow up with use-after-free.

Avoid this by setting CMD_T_ACTIVE in target_execute_cmd() so that
transport_wait_for_tasks() waits for the command to finish executing.
This matches the behavior from before commit 1389533ef944 ("target:
remove transport_generic_handle_data"), when data was signaled via
transport_generic_handle_data(), which set CMD_T_ACTIVE because it
called transport_add_cmd_to_queue().

Signed-off-by: Roland Dreier 
Reported-by: Martin Svec 
Cc: Christoph Hellwig 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

tcm_fc: Do not report target role when target is not defined

2013-01-21T19:44:33+00:00

commit edec8dfefa1f372b2dd8197da555352e76a10c03 upstream.

Clear the target role when no target is provided for
the node performing a PRLI.

Signed-off-by: Mark Rustad 
Reviewed-by: Bhanu Prakash Gollapudi 
Acked by Robert Love 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

tcm_fc: Do not indicate retry capability to initiators

2013-01-21T19:44:33+00:00

commit f2eeba214bcd0215b7f558cab6420e5fd153042b upstream.

When generating a PRLI response to an initiator, clear the
FCP_SPPF_RETRY bit in the response.

Signed-off-by: Mark Rustad 
Reviewed-by: Bhanu Prakash Gollapudi 
Acked by Robert Love 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: use correct sense code for LUN communication failure

2013-01-21T19:44:32+00:00

commit 18a9df42d53fabfa43b78be1104838cc8b9762e1 upstream.

The ASC/ASCQ code for 'Logical Unit Communication failure' is
0x08/0x00; 0x80/0x00 is vendor specific.

Signed-off-by: Hannes Reinecke 
Cc: Nicholas Bellinger 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iscsi-target: Fix CmdSN comparison (use cmd->cmd_sn instead of cmd->stat_sn)

2013-01-17T16:46:24+00:00

commit 64fe4f4f181cc2fe97d4176bf6ee6e3725ae33ec upstream.

Commit 64c13330a389 ("iscsi-target: Fix bug in handling of ExpStatSN
ACK during u32 wrap-around") introduced a bug where we compare the
wrong SN against our ExpCmdSN.

Reported-by: Ben Hutchings 
Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

sbp-target: fix error path in sbp_make_tpg()

2013-01-17T16:45:58+00:00

commit e1fe2060d7e8f58a69374135e32e90f0bb79a7fd upstream.

If the TPG memory is allocated successfully, but we fail further along
in the function, a dangling pointer to freed memory is left in the TPort
structure. This is mostly harmless, but does prevent re-trying the
operation without first removing the TPort altogether.

Reported-by: Chen Gang 
Signed-off-by: Chris Boot 
Cc: Andy Grover 
Cc: Nicholas A. Bellinger 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman