Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2228e43 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 

Pull scsi target fixes from Nicholas Bellinger:
 "Apologies for the late pull request.

  Here are the outstanding target-pending fixes for v4.1 code.

  The series contains three patches from Sagi + Co that address a few
  iser-target issues that have been uncovered during recent testing at
  Mellanox.

  Patch #1 has a v3.16+ stable tag, and #2-3 have v3.10+ stable tags"

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  iser-target: Fix possible use-after-free
  iser-target: release stale iser connections
  iser-target: Fix variable-length response error completion
parents 8f4ce072 524630d5

drivers/infiniband/ulp/isert/ib_isert.c

+22 −3
Original line number Diff line number Diff line
@@ -65,6 +65,8 @@ static int 
isert_rdma_accept(struct isert_conn *isert_conn);

struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);



static void isert_release_work(struct work_struct *work);



static inline bool

isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)

{
@@ -648,6 +650,7 @@ isert_init_conn(struct isert_conn *isert_conn) 
	mutex_init(&isert_conn->mutex);

	spin_lock_init(&isert_conn->pool_lock);

	INIT_LIST_HEAD(&isert_conn->fr_pool);

	INIT_WORK(&isert_conn->release_work, isert_release_work);

}



static void
@@ -925,6 +928,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, 
{

	struct isert_np *isert_np = cma_id->context;

	struct isert_conn *isert_conn;

	bool terminating = false;



	if (isert_np->np_cm_id == cma_id)

		return isert_np_cma_handler(cma_id->context, event);
@@ -932,12 +936,25 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, 
	isert_conn = cma_id->qp->qp_context;



	mutex_lock(&isert_conn->mutex);

	terminating = (isert_conn->state == ISER_CONN_TERMINATING);

	isert_conn_terminate(isert_conn);

	mutex_unlock(&isert_conn->mutex);



	isert_info("conn %p completing wait\n", isert_conn);

	complete(&isert_conn->wait);



	if (terminating)

		goto out;



	mutex_lock(&isert_np->np_accept_mutex);

	if (!list_empty(&isert_conn->accept_node)) {

		list_del_init(&isert_conn->accept_node);

		isert_put_conn(isert_conn);

		queue_work(isert_release_wq, &isert_conn->release_work);

	}

	mutex_unlock(&isert_np->np_accept_mutex);



out:

	return 0;

}
@@ -2380,7 +2397,6 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd, 
	page_off = offset % PAGE_SIZE;



	send_wr->sg_list = ib_sge;

	send_wr->num_sge = sg_nents;

	send_wr->wr_id = (uintptr_t)&isert_cmd->tx_desc;

	/*

	 * Perform mapping of TCM scatterlist memory ib_sge dma_addr.
@@ -2400,14 +2416,17 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd, 
			  ib_sge->addr, ib_sge->length, ib_sge->lkey);

		page_off = 0;

		data_left -= ib_sge->length;

		if (!data_left)

			break;

		ib_sge++;

		isert_dbg("Incrementing ib_sge pointer to %p\n", ib_sge);

	}



	send_wr->num_sge = ++i;

	isert_dbg("Set outgoing sg_list: %p num_sg: %u from TCM SGLs\n",

		  send_wr->sg_list, send_wr->num_sge);



	return sg_nents;

	return send_wr->num_sge;

}



static int
@@ -3366,7 +3385,6 @@ static void isert_wait_conn(struct iscsi_conn *conn) 
	isert_wait4flush(isert_conn);

	isert_wait4logout(isert_conn);



	INIT_WORK(&isert_conn->release_work, isert_release_work);

	queue_work(isert_release_wq, &isert_conn->release_work);

}
@@ -3374,6 +3392,7 @@ static void isert_free_conn(struct iscsi_conn *conn) 
{

	struct isert_conn *isert_conn = conn->context;



	isert_wait4flush(isert_conn);

	isert_put_conn(isert_conn);

}