Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 008bd2de authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 

Pull scsi target fixes from Nicholas Bellinger:
 "The highlights include:

   - Re-instate sess->wait_list in target_wait_for_sess_cmds() for
     active I/O shutdown handling in fabrics using se_cmd->cmd_kref
   - Make ib_srpt call target_sess_cmd_list_set_waiting() during session
     shutdown
   - Fix FILEIO off-by-one READ_CAPACITY bug for !S_ISBLK export
   - Fix iscsi-target login error heap buffer overflow (Kees)
   - Fix iscsi-target active I/O shutdown handling regression in
     v3.10-rc1

  A big thanks to Kees Cook for fixing a long standing login error
  buffer overflow bug.

  All patches are CC'ed to stable with the exception of the v3.10-rc1
  specific regression + other minor target cleanup."

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  iscsi-target: Fix iscsit_free_cmd() se_cmd->cmd_kref shutdown handling
  target: Propigate up ->cmd_kref put return via transport_generic_free_cmd
  iscsi-target: fix heap buffer overflow on error
  target/file: Fix off-by-one READ_CAPACITY bug for !S_ISBLK export
  ib_srpt: Call target_sess_cmd_list_set_waiting during shutdown_session
  target: Re-instate sess_wait_list for target_wait_for_sess_cmds
  target: Remove unused wait_for_tasks bit in target_wait_for_sess_cmds
parents 0f7dafd4 aafc9d15

drivers/infiniband/ulp/srpt/ib_srpt.c

+25 −9
Original line number Diff line number Diff line
@@ -2226,6 +2226,27 @@ static void srpt_close_ch(struct srpt_rdma_ch *ch) 
	spin_unlock_irq(&sdev->spinlock);

}



/**

 * srpt_shutdown_session() - Whether or not a session may be shut down.

 */

static int srpt_shutdown_session(struct se_session *se_sess)

{

	struct srpt_rdma_ch *ch = se_sess->fabric_sess_ptr;

	unsigned long flags;



	spin_lock_irqsave(&ch->spinlock, flags);

	if (ch->in_shutdown) {

		spin_unlock_irqrestore(&ch->spinlock, flags);

		return true;

	}



	ch->in_shutdown = true;

	target_sess_cmd_list_set_waiting(se_sess);

	spin_unlock_irqrestore(&ch->spinlock, flags);



	return true;

}



/**

 * srpt_drain_channel() - Drain a channel by resetting the IB queue pair.

 * @cm_id: Pointer to the CM ID of the channel to be drained.
@@ -2264,6 +2285,9 @@ static void srpt_drain_channel(struct ib_cm_id *cm_id) 
	spin_unlock_irq(&sdev->spinlock);



	if (do_reset) {

		if (ch->sess)

			srpt_shutdown_session(ch->sess);



		ret = srpt_ch_qp_err(ch);

		if (ret < 0)

			printk(KERN_ERR "Setting queue pair in error state"
@@ -2328,7 +2352,7 @@ static void srpt_release_channel_work(struct work_struct *w) 
	se_sess = ch->sess;

	BUG_ON(!se_sess);



	target_wait_for_sess_cmds(se_sess, 0);

	target_wait_for_sess_cmds(se_sess);



	transport_deregister_session_configfs(se_sess);

	transport_deregister_session(se_sess);
@@ -3466,14 +3490,6 @@ static void srpt_release_cmd(struct se_cmd *se_cmd) 
	spin_unlock_irqrestore(&ch->spinlock, flags);

}



/**

 * srpt_shutdown_session() - Whether or not a session may be shut down.

 */

static int srpt_shutdown_session(struct se_session *se_sess)

{

	return true;

}



/**

 * srpt_close_session() - Forcibly close a session.

 *

drivers/infiniband/ulp/srpt/ib_srpt.h

+1 −0
Original line number Diff line number Diff line
@@ -325,6 +325,7 @@ struct srpt_rdma_ch { 
	u8			sess_name[36];

	struct work_struct	release_work;

	struct completion	*release_done;

	bool			in_shutdown;

};



/**

drivers/scsi/qla2xxx/tcm_qla2xxx.c

+1 −1
Original line number Diff line number Diff line
@@ -1370,7 +1370,7 @@ static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess) 
		dump_stack();

		return;

	}

	target_wait_for_sess_cmds(se_sess, 0);

	target_wait_for_sess_cmds(se_sess);



	transport_deregister_session_configfs(sess->se_sess);

	transport_deregister_session(sess->se_sess);

drivers/target/iscsi/iscsi_target.c

+6 −6
Original line number Diff line number Diff line
@@ -651,7 +651,7 @@ static int iscsit_add_reject( 
	cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);

	if (!cmd->buf_ptr) {

		pr_err("Unable to allocate memory for cmd->buf_ptr\n");

		iscsit_release_cmd(cmd);

		iscsit_free_cmd(cmd, false);

		return -1;

	}
@@ -697,7 +697,7 @@ int iscsit_add_reject_from_cmd( 
	cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);

	if (!cmd->buf_ptr) {

		pr_err("Unable to allocate memory for cmd->buf_ptr\n");

		iscsit_release_cmd(cmd);

		iscsit_free_cmd(cmd, false);

		return -1;

	}
@@ -1743,7 +1743,7 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd, 
	return 0;

out:

	if (cmd)

		iscsit_release_cmd(cmd);

		iscsit_free_cmd(cmd, false);

ping_out:

	kfree(ping_data);

	return ret;
@@ -2251,7 +2251,7 @@ iscsit_handle_logout_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, 
	if (conn->conn_state != TARG_CONN_STATE_LOGGED_IN) {

		pr_err("Received logout request on connection that"

			" is not in logged in state, ignoring request.\n");

		iscsit_release_cmd(cmd);

		iscsit_free_cmd(cmd, false);

		return 0;

	}
@@ -3665,7 +3665,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state 
		list_del(&cmd->i_conn_node);

		spin_unlock_bh(&conn->cmd_lock);



		iscsit_free_cmd(cmd);

		iscsit_free_cmd(cmd, false);

		break;

	case ISTATE_SEND_NOPIN_WANT_RESPONSE:

		iscsit_mod_nopin_response_timer(conn);
@@ -4122,7 +4122,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) 


		iscsit_increment_maxcmdsn(cmd, sess);



		iscsit_free_cmd(cmd);

		iscsit_free_cmd(cmd, true);



		spin_lock_bh(&conn->cmd_lock);

	}

drivers/target/iscsi/iscsi_target_erl2.c

+6 −6
Original line number Diff line number Diff line
@@ -143,7 +143,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess) 
			list_del(&cmd->i_conn_node);

			cmd->conn = NULL;

			spin_unlock(&cr->conn_recovery_cmd_lock);

			iscsit_free_cmd(cmd);

			iscsit_free_cmd(cmd, true);

			spin_lock(&cr->conn_recovery_cmd_lock);

		}

		spin_unlock(&cr->conn_recovery_cmd_lock);
@@ -165,7 +165,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess) 
			list_del(&cmd->i_conn_node);

			cmd->conn = NULL;

			spin_unlock(&cr->conn_recovery_cmd_lock);

			iscsit_free_cmd(cmd);

			iscsit_free_cmd(cmd, true);

			spin_lock(&cr->conn_recovery_cmd_lock);

		}

		spin_unlock(&cr->conn_recovery_cmd_lock);
@@ -248,7 +248,7 @@ void iscsit_discard_cr_cmds_by_expstatsn( 
		iscsit_remove_cmd_from_connection_recovery(cmd, sess);



		spin_unlock(&cr->conn_recovery_cmd_lock);

		iscsit_free_cmd(cmd);

		iscsit_free_cmd(cmd, true);

		spin_lock(&cr->conn_recovery_cmd_lock);

	}

	spin_unlock(&cr->conn_recovery_cmd_lock);
@@ -302,7 +302,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn) 
		list_del(&cmd->i_conn_node);



		spin_unlock_bh(&conn->cmd_lock);

		iscsit_free_cmd(cmd);

		iscsit_free_cmd(cmd, true);

		spin_lock_bh(&conn->cmd_lock);

	}

	spin_unlock_bh(&conn->cmd_lock);
@@ -355,7 +355,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn) 


			list_del(&cmd->i_conn_node);

			spin_unlock_bh(&conn->cmd_lock);

			iscsit_free_cmd(cmd);

			iscsit_free_cmd(cmd, true);

			spin_lock_bh(&conn->cmd_lock);

			continue;

		}
@@ -375,7 +375,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn) 
		     iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {

			list_del(&cmd->i_conn_node);

			spin_unlock_bh(&conn->cmd_lock);

			iscsit_free_cmd(cmd);

			iscsit_free_cmd(cmd, true);

			spin_lock_bh(&conn->cmd_lock);

			continue;

		}