tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending

Pull SCSI target fixes from Nicholas Bellinger:
"This contains a v4.2-rc specific RCU module unload regression bug-fix,
a long-standing iscsi-target bug-fix for duplicate target_xfer_tags
during NOP processing from Alexei, and two more small REPORT_LUNs
emulation related patches to make Solaris FC host LUN scanning happy
from Roland.

There is also one patch not included that allows target-core to limit
the number of fabric driver SGLs per I/O request using residuals, that
is currently required as a work-around for FC hosts which don't honor
EVPD block-limits settings. At this point, it will most likely become
for-next material"

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
target: Fix handling of small allocation lengths in REPORT LUNS
target: REPORT LUNS should return LUN 0 even for dynamic ACLs
target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT
target: Perform RCU callback barrier before backend/fabric unload

Linus Torvalds 3243f50b 3bd8f7d8

+44 -23
+2 -2
drivers/target/iscsi/iscsi_target.c
··· 968 968 cmd->cmd_flags |= ICF_NON_IMMEDIATE_UNSOLICITED_DATA; 969 969 970 970 conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt; 971 - if (hdr->flags & ISCSI_FLAG_CMD_READ) { 971 + if (hdr->flags & ISCSI_FLAG_CMD_READ) 972 972 cmd->targ_xfer_tag = session_get_next_ttt(conn->sess); 973 - } else if (hdr->flags & ISCSI_FLAG_CMD_WRITE) 973 + else 974 974 cmd->targ_xfer_tag = 0xFFFFFFFF; 975 975 cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); 976 976 cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
+8 -1
drivers/target/target_core_configfs.c
··· 457 457 if (!strcmp(t->tf_ops->name, fo->name)) { 458 458 BUG_ON(atomic_read(&t->tf_access_cnt)); 459 459 list_del(&t->tf_list); 460 + mutex_unlock(&g_tf_lock); 461 + /* 462 + * Wait for any outstanding fabric se_deve_entry->rcu_head 463 + * callbacks to complete post kfree_rcu(), before allowing 464 + * fabric driver unload of TFO->module to proceed. 465 + */ 466 + rcu_barrier(); 460 467 kfree(t); 461 - break; 468 + return; 462 469 } 463 470 } 464 471 mutex_unlock(&g_tf_lock);
+9 -1
drivers/target/target_core_hba.c
··· 84 84 list_for_each_entry(tb, &backend_list, list) { 85 85 if (tb->ops == ops) { 86 86 list_del(&tb->list); 87 + mutex_unlock(&backend_mutex); 88 + /* 89 + * Wait for any outstanding backend driver ->rcu_head 90 + * callbacks to complete post TBO->free_device() -> 91 + * call_rcu(), before allowing backend driver module 92 + * unload of target_backend_ops->owner to proceed. 93 + */ 94 + rcu_barrier(); 87 95 kfree(tb); 88 - break; 96 + return; 89 97 } 90 98 } 91 99 mutex_unlock(&backend_mutex);
+25 -19
drivers/target/target_core_spc.c
··· 1203 1203 struct se_dev_entry *deve; 1204 1204 struct se_session *sess = cmd->se_sess; 1205 1205 struct se_node_acl *nacl; 1206 + struct scsi_lun slun; 1206 1207 unsigned char *buf; 1207 1208 u32 lun_count = 0, offset = 8; 1208 - 1209 - if (cmd->data_length < 16) { 1210 - pr_warn("REPORT LUNS allocation length %u too small\n", 1211 - cmd->data_length); 1212 - return TCM_INVALID_CDB_FIELD; 1213 - } 1209 + __be32 len; 1214 1210 1215 1211 buf = transport_kmap_data_sg(cmd); 1216 - if (!buf) 1212 + if (cmd->data_length && !buf) 1217 1213 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; 1218 1214 1219 1215 /* ··· 1217 1221 * coming via a target_core_mod PASSTHROUGH op, and not through 1218 1222 * a $FABRIC_MOD. In that case, report LUN=0 only. 1219 1223 */ 1220 - if (!sess) { 1221 - int_to_scsilun(0, (struct scsi_lun *)&buf[offset]); 1222 - lun_count = 1; 1224 + if (!sess) 1223 1225 goto done; 1224 - } 1226 + 1225 1227 nacl = sess->se_node_acl; 1226 1228 1227 1229 rcu_read_lock(); ··· 1230 1236 * See SPC2-R20 7.19. 1231 1237 */ 1232 1238 lun_count++; 1233 - if ((offset + 8) > cmd->data_length) 1239 + if (offset >= cmd->data_length) 1234 1240 continue; 1235 1241 1236 - int_to_scsilun(deve->mapped_lun, (struct scsi_lun *)&buf[offset]); 1242 + int_to_scsilun(deve->mapped_lun, &slun); 1243 + memcpy(buf + offset, &slun, 1244 + min(8u, cmd->data_length - offset)); 1237 1245 offset += 8; 1238 1246 } 1239 1247 rcu_read_unlock(); ··· 1244 1248 * See SPC3 r07, page 159. 1245 1249 */ 1246 1250 done: 1247 - lun_count *= 8; 1248 - buf[0] = ((lun_count >> 24) & 0xff); 1249 - buf[1] = ((lun_count >> 16) & 0xff); 1250 - buf[2] = ((lun_count >> 8) & 0xff); 1251 - buf[3] = (lun_count & 0xff); 1252 - transport_kunmap_data_sg(cmd); 1251 + /* 1252 + * If no LUNs are accessible, report virtual LUN 0. 1253 + */ 1254 + if (lun_count == 0) { 1255 + int_to_scsilun(0, &slun); 1256 + if (cmd->data_length > 8) 1257 + memcpy(buf + offset, &slun, 1258 + min(8u, cmd->data_length - offset)); 1259 + lun_count = 1; 1260 + } 1261 + 1262 + if (buf) { 1263 + len = cpu_to_be32(lun_count * 8); 1264 + memcpy(buf, &len, min_t(int, sizeof len, cmd->data_length)); 1265 + transport_kunmap_data_sg(cmd); 1266 + } 1253 1267 1254 1268 target_complete_cmd_with_length(cmd, GOOD, 8 + lun_count * 8); 1255 1269 return 0;