Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb477e03 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 

Pull SCSI target fixes from Nicholas Bellinger:
 "Mostly minor fixes this time around.  The highlights include:

   - iscsi-target CHAP authentication fixes to enforce explicit key
     values (Tejas Vaykole + rahul.rane)
   - fix a long-standing OOPs in target-core when a alua configfs
     attribute is accessed after port symlink has been removed.
     (Sebastian Herbszt)
   - fix a v3.10.y iscsi-target regression causing the login reject
     status class/detail to be ignored (Christoph Vu-Brugier)
   - fix a v3.10.y iscsi-target regression to avoid rejecting an
     existing ITT during Data-Out when data-direction is wrong (Santosh
     Kulkarni + Arshad Hussain)
   - fix a iscsi-target related shutdown deadlock on UP kernels (Mikulas
     Patocka)
   - fix a v3.16-rc1 build issue with vhost-scsi + !CONFIG_NET (MST)"

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  iscsi-target: fix iscsit_del_np deadlock on unload
  iovec: move memcpy_from/toiovecend to lib/iovec.c
  iscsi-target: Avoid rejecting incorrect ITT for Data-Out
  tcm_loop: Fix memory leak in tcm_loop_submission_work error path
  iscsi-target: Explicily clear login response PDU in exception path
  target: Fix left-over se_lun->lun_sep pointer OOPs
  iscsi-target; Enforce 1024 byte maximum for CHAP_C key value
  iscsi-target: Convert chap_server_compute_md5 to use kstrtoul
parents 3e7b256c 81a9c5e7

drivers/target/iscsi/iscsi_target.c

+1 −1
Original line number Diff line number Diff line
@@ -1309,7 +1309,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf, 
	if (cmd->data_direction != DMA_TO_DEVICE) {

		pr_err("Command ITT: 0x%08x received DataOUT for a"

			" NON-WRITE command.\n", cmd->init_task_tag);

		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);

		return iscsit_dump_data_payload(conn, payload_length, 1);

	}

	se_cmd = &cmd->se_cmd;

	iscsit_mod_dataout_timer(cmd);

drivers/target/iscsi/iscsi_target_auth.c

+11 −3
Original line number Diff line number Diff line
@@ -174,7 +174,6 @@ static int chap_server_compute_md5( 
	char *nr_out_ptr,

	unsigned int *nr_out_len)

{

	char *endptr;

	unsigned long id;

	unsigned char id_as_uchar;

	unsigned char digest[MD5_SIGNATURE_SIZE];
@@ -320,9 +319,14 @@ static int chap_server_compute_md5( 
	}



	if (type == HEX)

		id = simple_strtoul(&identifier[2], &endptr, 0);

		ret = kstrtoul(&identifier[2], 0, &id);

	else

		id = simple_strtoul(identifier, &endptr, 0);

		ret = kstrtoul(identifier, 0, &id);



	if (ret < 0) {

		pr_err("kstrtoul() failed for CHAP identifier: %d\n", ret);

		goto out;

	}

	if (id > 255) {

		pr_err("chap identifier: %lu greater than 255\n", id);

		goto out;
@@ -351,6 +355,10 @@ static int chap_server_compute_md5( 
		pr_err("Unable to convert incoming challenge\n");

		goto out;

	}

	if (challenge_len > 1024) {

		pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");

		goto out;

	}

	/*

	 * During mutual authentication, the CHAP_C generated by the

	 * initiator must not match the original CHAP_C generated by

drivers/target/iscsi/iscsi_target_login.c

+7 −6
Original line number Diff line number Diff line
@@ -1216,7 +1216,7 @@ old_sess_out: 
static int __iscsi_target_login_thread(struct iscsi_np *np)

{

	u8 *buffer, zero_tsih = 0;

	int ret = 0, rc, stop;

	int ret = 0, rc;

	struct iscsi_conn *conn = NULL;

	struct iscsi_login *login;

	struct iscsi_portal_group *tpg = NULL;
@@ -1230,6 +1230,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) 
	if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {

		np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;

		complete(&np->np_restart_comp);

	} else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {

		spin_unlock_bh(&np->np_thread_lock);

		goto exit;

	} else {

		np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;

	}
@@ -1422,10 +1425,8 @@ old_sess_out: 
	}



out:

	stop = kthread_should_stop();

	/* Wait for another socket.. */

	if (!stop)

	return 1;



exit:

	iscsi_stop_login_thread_timer(np);

	spin_lock_bh(&np->np_thread_lock);
@@ -1442,7 +1443,7 @@ int iscsi_target_login_thread(void *arg) 


	allow_signal(SIGINT);



	while (!kthread_should_stop()) {

	while (1) {

		ret = __iscsi_target_login_thread(np);

		/*

		 * We break and exit here unless another sock_accept() call

drivers/target/iscsi/iscsi_target_util.c

+2 −0
Original line number Diff line number Diff line
@@ -1295,6 +1295,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta 
	login->login_failed = 1;

	iscsit_collect_login_stats(conn, status_class, status_detail);



	memset(&login->rsp[0], 0, ISCSI_HDR_LEN);



	hdr	= (struct iscsi_login_rsp *)&login->rsp[0];

	hdr->opcode		= ISCSI_OP_LOGIN_RSP;

	hdr->status_class	= status_class;

drivers/target/loopback/tcm_loop.c

+1 −0
Original line number Diff line number Diff line
@@ -239,6 +239,7 @@ static void tcm_loop_submission_work(struct work_struct *work) 
	return;



out_done:

	kmem_cache_free(tcm_loop_cmd_cache, tl_cmd);

	sc->scsi_done(sc);

	return;

}