linux-toradex.git/drivers/target, branch v4.9.9

sbp-target: Fix second argument of percpu_ida_alloc()

2017-01-12T10:39:30+00:00

commit 8456066a57940b3884aa080c58b166567dc9de39 upstream.

Pass a task state as second argument to percpu_ida_alloc().

Fixes: commit 5a3ee221b543 ("sbp-target: Conversion to percpu_ida tag pre-allocation")
Signed-off-by: Bart Van Assche 
Cc: Chris Boot 
Signed-off-by: Greg Kroah-Hartman

target/iscsi: Fix double free in lio_target_tiqn_addtpg()

2017-01-12T10:39:30+00:00

commit a91918cd3ea11f91c68e08e1e8ce1b560447a80e upstream.

This iscsit_tpg_add_portal_group() function is only called from
lio_target_tiqn_addtpg().  Both functions free the "tpg" pointer on
error so it's a double free bug.  The memory is allocated in the caller
so it should be freed in the caller and not here.

Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Signed-off-by: Dan Carpenter 
Reviewed-by: David Disseldorp 
[ bvanassche: Added "Fix" at start of patch title ]
Signed-off-by: Bart Van Assche 
Signed-off-by: Greg Kroah-Hartman

target/user: Fix use-after-free of tcmu_cmds if they are expired

2017-01-09T07:32:25+00:00

commit d0905ca757bc40bd1ebc261a448a521b064777d7 upstream.

Don't free the cmd in tcmu_check_expired_cmd, it's still referenced by
an entry in our cmd_id->cmd idr. If userspace ever resumes processing,
tcmu_handle_completions() will use the now-invalid cmd pointer.

Instead, don't free cmd. It will be freed by tcmu_handle_completion() if
userspace ever recovers, or tcmu_free_device if not.

Reported-by: Bryant G Ly 
Tested-by: Bryant G Ly 
Signed-off-by: Andy Grover 
Signed-off-by: Bart Van Assche 
Signed-off-by: Greg Kroah-Hartman

iscsi-target: Return error if unable to add network portal

2017-01-09T07:32:21+00:00

commit 83337e544323a8bd7492994d64af339175ac7107 upstream.

If iscsit_tpg_add_network_portal() fails then
return error code instead of 0 to user space.

If iscsi-target returns 0 then user space keeps
on retrying same command infinitely, targetcli or
echo hangs till command completes with non zero
return value. In some cases it is possible that
add network portal command never completes with
success even after retrying multiple times,
for example - cxgbit_setup_np() always returns
-EINVAL if portal IP does not belong to Chelsio
adapter interface.

Signed-off-by: Varun Prakash 
Signed-off-by: Bart Van Assche 
[ bvanassche: Added "Fixes:" and "Cc: stable" tags ]
Fixes: commit d4b3fa4b0881 ("iscsi-target: Make iscsi_tpg_np driver show/store use generic code")
Signed-off-by: Greg Kroah-Hartman

target/tcm_fc: use CPU affinity for responses

2016-10-21T08:19:44+00:00

The libfc stack assigns exchange IDs based on the CPU the request
was received on, so we need to send the responses via the same CPU.
Otherwise the send logic gets confuses and responses will be delayed,
causing exchange timeouts on the initiator side.

Signed-off-by: Hannes Reinecke 
Cc: stable@vger.kernel.org # 4.5+
Signed-off-by: Nicholas Bellinger

target/tcm_fc: Update debugging statements to match libfc usage

2016-10-21T08:19:43+00:00

Update the debug statements to match those from libfc.

Signed-off-by: Hannes Reinecke 
Signed-off-by: Nicholas Bellinger

target/tcm_fc: return detailed error in ft_sess_create()

2016-10-21T08:19:42+00:00

Not every failure is due to out-of-memory; the ACLs might not be
set, too. So return a detailed error code in ft_sess_create()
instead of just a NULL pointer.

Signed-off-by: Hannes Reinecke 
Signed-off-by: Nicholas Bellinger

target/tcm_fc: print command pointer in debug message

2016-10-21T08:19:42+00:00

When allocating a new command we should add the pointer to the
debug statements; that allows us to match this with other debug
statements for handling data.

Signed-off-by: Hannes Reinecke 
Signed-off-by: Nicholas Bellinger

target: fix potential race window in target_sess_cmd_list_waiting()

2016-10-21T08:19:41+00:00

target_sess_cmd_list_waiting() might hit on a condition where
the kref for the command is already 0, but the destructor has
not been called yet (or is stuck in waiting for a spin lock).
Rather than leaving the command on the list we should explicitly
remove it to avoid race issues later on.

Signed-off-by: Hannes Reinecke 
Signed-off-by: Nicholas Bellinger

Revert "target: Fix residual overflow handling in target_complete_cmd_with_length"

2016-10-20T04:22:34+00:00

This reverts commit c1ccbfe0311e2380a6d2dcb0714b36904f5d586f.

Reverting this patch, as it incorrectly assumes the additional length
for INQUIRY in target_complete_cmd_with_length() is SCSI allocation
length, which breaks existing user-space code when SCSI allocation
length is smaller than additional length.

  root@scsi-mq:~# sg_inq --len=4 -vvvv /dev/sdb
  found bsg_major=253
  open /dev/sdb with flags=0x800
      inquiry cdb: 12 00 00 00 04 00
        duration=0 ms
      inquiry: pass-through requested 4 bytes (data-in) but got -28 bytes
      inquiry: pass-through can't get negative bytes, say it got none
      inquiry: got too few bytes (0)
  INQUIRY resid (32) should never exceed requested len=4
      inquiry: failed requesting 4 byte response: Malformed response to
               SCSI command [resid=32]

AFAICT the original change was not to address a specific host issue,
so go ahead and revert to original logic for now.

Cc: Douglas Gilbert 
Cc: Martin K. Petersen 
Cc: Sumit Rai 
Cc: stable@vger.kernel.org # 4.8+
Signed-off-by: Nicholas Bellinger