Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a1f7b3d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/scsi-post-merge-2.6 

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/scsi-post-merge-2.6:
  tcm_fc: Fix conversion spec warning
  tcm_fc: Fix possible lock to unlock type deadlock
  tcm_fc: Fix ft_send_tm LUN lookup OOPs
  target: Fix incorrect strlen() NULL terminator checks
  target: Drop bogus ERR_PTR usage in target_fabric_configfs_init
  target: Fix ERR_PTR dereferencing bugs
  target: Convert transport_deregister_session_configfs nacl_sess_lock to save irq state
  target: Fix transport_get_lun_for_tmr failure cases
  [SCSI] target: Convert TASK_ATTR to scsi_tcq.h definitions
  [SCSI] target: Convert REPORT_LUNs to use int_to_scsilun
  [SCSI] target: Fix task->task_execute_queue=1 clear bug + LUN_RESET OOPs
  [SCSI] target: Fix bug with task_sg chained transport_free_dev_tasks release
  [SCSI] target: Fix interrupt context bug with stats_lock and core_tmr_alloc_req
  [SCSI] target: Fix multi task->task_sg[] chaining logic bug
parents 12f1ba5a 95efa286

drivers/target/loopback/tcm_loop.c

+8 −5
Original line number Diff line number Diff line
@@ -386,7 +386,7 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc) 
	 */

	se_cmd->se_tmr_req = core_tmr_alloc_req(se_cmd, (void *)tl_tmr,

				TMR_LUN_RESET);

	if (!se_cmd->se_tmr_req)

	if (IS_ERR(se_cmd->se_tmr_req))

		goto release;

	/*

	 * Locate the underlying TCM struct se_lun from sc->device->lun
@@ -1017,6 +1017,7 @@ static int tcm_loop_make_nexus( 
	struct se_portal_group *se_tpg;

	struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;

	struct tcm_loop_nexus *tl_nexus;

	int ret = -ENOMEM;



	if (tl_tpg->tl_hba->tl_nexus) {

		printk(KERN_INFO "tl_tpg->tl_hba->tl_nexus already exists\n");
@@ -1033,8 +1034,10 @@ static int tcm_loop_make_nexus( 
	 * Initialize the struct se_session pointer

	 */

	tl_nexus->se_sess = transport_init_session();

	if (!tl_nexus->se_sess)

	if (IS_ERR(tl_nexus->se_sess)) {

		ret = PTR_ERR(tl_nexus->se_sess);

		goto out;

	}

	/*

	 * Since we are running in 'demo mode' this call with generate a

	 * struct se_node_acl for the tcm_loop struct se_portal_group with the SCSI
@@ -1060,7 +1063,7 @@ static int tcm_loop_make_nexus( 


out:

	kfree(tl_nexus);

	return -ENOMEM;

	return ret;

}



static int tcm_loop_drop_nexus(
@@ -1140,7 +1143,7 @@ static ssize_t tcm_loop_tpg_store_nexus( 
	 * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call

	 * tcm_loop_make_nexus()

	 */

	if (strlen(page) > TL_WWN_ADDR_LEN) {

	if (strlen(page) >= TL_WWN_ADDR_LEN) {

		printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds"

				" max: %d\n", page, TL_WWN_ADDR_LEN);

		return -EINVAL;
@@ -1321,7 +1324,7 @@ struct se_wwn *tcm_loop_make_scsi_hba( 
	return ERR_PTR(-EINVAL);



check_len:

	if (strlen(name) > TL_WWN_ADDR_LEN) {

	if (strlen(name) >= TL_WWN_ADDR_LEN) {

		printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds"

			" max: %d\n", name, tcm_loop_dump_proto_id(tl_hba),

			TL_WWN_ADDR_LEN);

drivers/target/target_core_configfs.c

+12 −12
Original line number Diff line number Diff line
@@ -304,7 +304,7 @@ struct target_fabric_configfs *target_fabric_configfs_init( 
		printk(KERN_ERR "Unable to locate passed fabric name\n");

		return NULL;

	}

	if (strlen(name) > TARGET_FABRIC_NAME_SIZE) {

	if (strlen(name) >= TARGET_FABRIC_NAME_SIZE) {

		printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC"

			"_NAME_SIZE\n", name);

		return NULL;
@@ -312,7 +312,7 @@ struct target_fabric_configfs *target_fabric_configfs_init( 


	tf = kzalloc(sizeof(struct target_fabric_configfs), GFP_KERNEL);

	if (!(tf))

		return ERR_PTR(-ENOMEM);

		return NULL;



	INIT_LIST_HEAD(&tf->tf_list);

	atomic_set(&tf->tf_access_cnt, 0);
@@ -851,7 +851,7 @@ static ssize_t target_core_dev_wwn_store_attr_vpd_unit_serial( 
		return -EOPNOTSUPP;

	}



	if ((strlen(page) + 1) > INQUIRY_VPD_SERIAL_LEN) {

	if (strlen(page) >= INQUIRY_VPD_SERIAL_LEN) {

		printk(KERN_ERR "Emulated VPD Unit Serial exceeds"

		" INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN);

		return -EOVERFLOW;
@@ -917,7 +917,7 @@ static ssize_t target_core_dev_wwn_show_attr_vpd_protocol_identifier( 


		transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE);



		if ((len + strlen(buf) > PAGE_SIZE))

		if ((len + strlen(buf) >= PAGE_SIZE))

			break;



		len += sprintf(page+len, "%s", buf);
@@ -962,19 +962,19 @@ static ssize_t target_core_dev_wwn_show_attr_##_name( \ 
									\

		memset(buf, 0, VPD_TMP_BUF_SIZE);			\

		transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE);	\

		if ((len + strlen(buf) > PAGE_SIZE))			\

		if ((len + strlen(buf) >= PAGE_SIZE))			\

			break;						\

		len += sprintf(page+len, "%s", buf);			\

									\

		memset(buf, 0, VPD_TMP_BUF_SIZE);			\

		transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \

		if ((len + strlen(buf) > PAGE_SIZE))			\

		if ((len + strlen(buf) >= PAGE_SIZE))			\

			break;						\

		len += sprintf(page+len, "%s", buf);			\

									\

		memset(buf, 0, VPD_TMP_BUF_SIZE);			\

		transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \

		if ((len + strlen(buf) > PAGE_SIZE))			\

		if ((len + strlen(buf) >= PAGE_SIZE))			\

			break;						\

		len += sprintf(page+len, "%s", buf);			\

	}								\
@@ -1299,7 +1299,7 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts( 
			&i_buf[0] : "", pr_reg->pr_res_key,

			pr_reg->pr_res_generation);



		if ((len + strlen(buf) > PAGE_SIZE))

		if ((len + strlen(buf) >= PAGE_SIZE))

			break;



		len += sprintf(page+len, "%s", buf);
@@ -1496,7 +1496,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( 
				ret = -ENOMEM;

				goto out;

			}

			if (strlen(i_port) > PR_APTPL_MAX_IPORT_LEN) {

			if (strlen(i_port) >= PR_APTPL_MAX_IPORT_LEN) {

				printk(KERN_ERR "APTPL metadata initiator_node="

					" exceeds PR_APTPL_MAX_IPORT_LEN: %d\n",

					PR_APTPL_MAX_IPORT_LEN);
@@ -1510,7 +1510,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( 
				ret = -ENOMEM;

				goto out;

			}

			if (strlen(isid) > PR_REG_ISID_LEN) {

			if (strlen(isid) >= PR_REG_ISID_LEN) {

				printk(KERN_ERR "APTPL metadata initiator_isid"

					"= exceeds PR_REG_ISID_LEN: %d\n",

					PR_REG_ISID_LEN);
@@ -1571,7 +1571,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( 
				ret = -ENOMEM;

				goto out;

			}

			if (strlen(t_port) > PR_APTPL_MAX_TPORT_LEN) {

			if (strlen(t_port) >= PR_APTPL_MAX_TPORT_LEN) {

				printk(KERN_ERR "APTPL metadata target_node="

					" exceeds PR_APTPL_MAX_TPORT_LEN: %d\n",

					PR_APTPL_MAX_TPORT_LEN);
@@ -3052,7 +3052,7 @@ static struct config_group *target_core_call_addhbatotarget( 
	int ret;



	memset(buf, 0, TARGET_CORE_NAME_MAX_LEN);

	if (strlen(name) > TARGET_CORE_NAME_MAX_LEN) {

	if (strlen(name) >= TARGET_CORE_NAME_MAX_LEN) {

		printk(KERN_ERR "Passed *name strlen(): %d exceeds"

			" TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name),

			TARGET_CORE_NAME_MAX_LEN);

drivers/target/target_core_device.c

+3 −2
Original line number Diff line number Diff line
@@ -192,7 +192,7 @@ int transport_get_lun_for_tmr( 
			&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];

	if (deve->lun_flags & TRANSPORT_LUNFLAGS_INITIATOR_ACCESS) {

		se_lun = se_cmd->se_lun = se_tmr->tmr_lun = deve->se_lun;

		dev = se_tmr->tmr_dev = se_lun->lun_se_dev;

		dev = se_lun->lun_se_dev;

		se_cmd->pr_res_key = deve->pr_res_key;

		se_cmd->orig_fe_lun = unpacked_lun;

		se_cmd->se_orig_obj_ptr = SE_LUN(se_cmd)->lun_se_dev;
@@ -216,6 +216,7 @@ int transport_get_lun_for_tmr( 
		se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;

		return -1;

	}

	se_tmr->tmr_dev = dev;



	spin_lock(&dev->se_tmr_lock);

	list_add_tail(&se_tmr->tmr_list, &dev->dev_tmr_list);
@@ -1430,7 +1431,7 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl( 
	struct se_lun_acl *lacl;

	struct se_node_acl *nacl;



	if (strlen(initiatorname) > TRANSPORT_IQN_LEN) {

	if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) {

		printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n",

			TPG_TFO(tpg)->get_fabric_name());

		*ret = -EOVERFLOW;

drivers/target/target_core_pr.c

+3 −3
Original line number Diff line number Diff line
@@ -1916,7 +1916,7 @@ static int __core_scsi3_update_aptpl_buf( 
				pr_reg->pr_res_mapped_lun);

		}



		if ((len + strlen(tmp) > pr_aptpl_buf_len)) {

		if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {

			printk(KERN_ERR "Unable to update renaming"

				" APTPL metadata\n");

			spin_unlock(&T10_RES(su_dev)->registration_lock);
@@ -1934,7 +1934,7 @@ static int __core_scsi3_update_aptpl_buf( 
			TPG_TFO(tpg)->tpg_get_tag(tpg),

			lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count);



		if ((len + strlen(tmp) > pr_aptpl_buf_len)) {

		if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {

			printk(KERN_ERR "Unable to update renaming"

				" APTPL metadata\n");

			spin_unlock(&T10_RES(su_dev)->registration_lock);
@@ -1986,7 +1986,7 @@ static int __core_scsi3_write_aptpl_to_file( 
	memset(iov, 0, sizeof(struct iovec));

	memset(path, 0, 512);



	if (strlen(&wwn->unit_serial[0]) > 512) {

	if (strlen(&wwn->unit_serial[0]) >= 512) {

		printk(KERN_ERR "WWN value for struct se_device does not fit"

			" into path buffer\n");

		return -1;

drivers/target/target_core_tmr.c

+7 −1
Original line number Diff line number Diff line
@@ -75,10 +75,16 @@ void core_tmr_release_req( 
{

	struct se_device *dev = tmr->tmr_dev;



	if (!dev) {

		kmem_cache_free(se_tmr_req_cache, tmr);

		return;

	}



	spin_lock(&dev->se_tmr_lock);

	list_del(&tmr->tmr_list);

	kmem_cache_free(se_tmr_req_cache, tmr);

	spin_unlock(&dev->se_tmr_lock);



	kmem_cache_free(se_tmr_req_cache, tmr);

}



static void core_tmr_handle_tas_abort(