linux-toradex.git/include/target, branch v5.7-rc6

scsi: target: fix hang when multiple threads try to destroy the same iscsi session

2020-03-27T01:47:47+00:00

A number of hangs have been reported against the target driver; they are
due to the fact that multiple threads may try to destroy the iscsi session
at the same time. This may be reproduced for example when a "targetcli
iscsi/iqn.../tpg1 disable" command is executed while a logout operation is
underway.

When this happens, two or more threads may end up sleeping and waiting for
iscsit_close_connection() to execute "complete(session_wait_comp)".  Only
one of the threads will wake up and proceed to destroy the session
structure, the remaining threads will hang forever.

Note that if the blocked threads are somehow forced to wake up with
complete_all(), they will try to free the same iscsi session structure
destroyed by the first thread, causing double frees, memory corruptions
etc...

With this patch, the threads that want to destroy the iscsi session will
increase the session refcount and will set the "session_close" flag to 1;
then they wait for the driver to close the remaining active connections.
When the last connection is closed, iscsit_close_connection() will wake up
all the threads and will wait for the session's refcount to reach zero;
when this happens, iscsit_close_connection() will destroy the session
structure because no one is referencing it anymore.

 INFO: task targetcli:5971 blocked for more than 120 seconds.
       Tainted: P           OE    4.15.0-72-generic #81~16.04.1
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 targetcli       D    0  5971      1 0x00000080
 Call Trace:
  __schedule+0x3d6/0x8b0
  ? vprintk_func+0x44/0xe0
  schedule+0x36/0x80
  schedule_timeout+0x1db/0x370
  ? __dynamic_pr_debug+0x8a/0xb0
  wait_for_completion+0xb4/0x140
  ? wake_up_q+0x70/0x70
  iscsit_free_session+0x13d/0x1a0 [iscsi_target_mod]
  iscsit_release_sessions_for_tpg+0x16b/0x1e0 [iscsi_target_mod]
  iscsit_tpg_disable_portal_group+0xca/0x1c0 [iscsi_target_mod]
  lio_target_tpg_enable_store+0x66/0xe0 [iscsi_target_mod]
  configfs_write_file+0xb9/0x120
  __vfs_write+0x1b/0x40
  vfs_write+0xb8/0x1b0
  SyS_write+0x5c/0xe0
  do_syscall_64+0x73/0x130
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2

Link: https://lore.kernel.org/r/20200313170656.9716-3-mlombard@redhat.com
Reported-by: Matt Coleman 
Tested-by: Matt Coleman 
Tested-by: Rahul Kundu 
Signed-off-by: Maurizio Lombardi 
Signed-off-by: Martin K. Petersen

scsi: treewide: Consolidate {get,put}_unaligned_[bl]e24() definitions

2020-03-17T02:08:34+00:00

Move the get_unaligned_be24(), get_unaligned_le24() and
put_unaligned_le24() definitions from various drivers into
include/linux/unaligned/generic.h. Add a put_unaligned_be24()
implementation.

Link: https://lore.kernel.org/r/20200313203102.16613-4-bvanassche@acm.org
Cc: Keith Busch 
Cc: Sagi Grimberg 
Cc: Jens Axboe 
Cc: Harvey Harrison 
Cc: Martin K. Petersen 
Cc: Ingo Molnar 
Cc: Thomas Gleixner 
Cc: H. Peter Anvin 
Cc: Andrew Morton 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Andy Shevchenko 
Reviewed-by: Greg Kroah-Hartman  # For drivers/usb
Reviewed-by: Felipe Balbi  # For drivers/usb/gadget
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target: use an enum to track emulate_ua_intlck_ctrl

2020-02-21T22:37:16+00:00

The emulate_ua_intlck_ctrl device attribute accepts values of 0, 1 or 2 via
ConfigFS, which map to unit attention interlocks control codes in the MODE
SENSE control Mode Page.  Use an enum to track these values so that it's
clear that, unlike the remaining emulate_X attributes,
emulate_ua_intlck_ctrl isn't boolean.

Link: https://marc.info/?l=target-devel&m=158227825428798
Suggested-by: Bart Van Assche 
Signed-off-by: David Disseldorp 
Signed-off-by: Martin K. Petersen

scsi: target: convert boolean se_dev_attrib types to bool

2020-02-21T22:37:14+00:00

This should harden us against configfs API regressions similar to the one
fixed by the previous commit.

Link: https://marc.info/?l=target-devel&m=158211731505174
Signed-off-by: David Disseldorp 
Reviewed-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target: fix unmap_zeroes_data boolean initialisation

2020-02-21T22:37:13+00:00

The LIO unmap_zeroes_data device attribute is mapped to the LBPRZ flag in
the READ CAPACITY(16) and Thin Provisioning VPD INQUIRY responses.

The unmap_zeroes_data attribute is exposed via configfs, where any write
value is correctly validated via strtobool(). However, when initialised via
target_configure_unmap_from_queue() it takes the value of the device's
max_write_zeroes_sectors queue limit, which is non-boolean.

A non-boolean value can be read from configfs, but attempting to write the
same value back results in -EINVAL, causing problems for configuration
utilities such as targetcli.

Link: https://marc.info/?l=target-devel&m=158213354011309
Fixes: 2237498f0b5c ("target/iblock: Convert WRITE_SAME to blkdev_issue_zeroout")
Reviewed-by: Bart Van Assche 
Signed-off-by: David Disseldorp 
Signed-off-by: Martin K. Petersen

scsi: target: Remove tpg_list and se_portal_group.se_tpg_node

2019-10-04T02:00:09+00:00

Maintaining tpg_list without ever iterating over it is not useful. Hence
remove tpg_list. This patch does not change the behavior of the SCSI target
code.

Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Nicholas Bellinger 
Link: https://lore.kernel.org/r/20190930232224.58980-1-bvanassche@acm.org
Signed-off-by: Bart Van Assche 
Reviewed-by: Mike Christie 
Signed-off-by: Martin K. Petersen

scsi: target/iscsi: Handle too large immediate data buffers correctly

2019-04-13T00:20:06+00:00

Since target_alloc_sgl() and iscsit_allocate_iovecs() allocate buffer space
for se_cmd.data_length bytes and since that number can be smaller than the
iSCSI Expected Data Transfer Length (EDTL), ensure that the iSCSI target
driver does not attempt to receive more bytes than what fits in the receive
buffer. Always receive the full immediate data buffer such that the iSCSI
target driver does not attempt to parse immediate data as an iSCSI PDU.

Note: the current code base only calls iscsit_get_dataout() if the size of
the immediate data buffer does not exceed the buffer size derived from the
SCSI CDB. See also target_cmd_size_check().

Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Nicholas Bellinger 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Rework the SPC-2 reservation handling code

2019-04-13T00:20:05+00:00

Instead of tracking the initiator that established an SPC-2 reservation,
track the session through which the SPC-2 reservation has been
established. This patch does not change any functionality.

Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Nicholas Bellinger 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/iscsi: Rename a function and a function pointer

2019-02-05T02:34:49+00:00

Having both a function and a function pointer member with the same
name (iscsit_release_cmd) is confusing. Hence rename the function pointer
member.

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/iscsi: Fix spelling of "unsolicited"

2019-02-05T02:33:59+00:00

Change "unsoliticed" into "unsolicited".

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Sagi Grimberg 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen