Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull scsi target fixes from Nicholas Bellinger:
"Apologies for the late pull request.
Here are the outstanding target-pending fixes for v4.1 code.
The series contains three patches from Sagi + Co that address a few
iser-target issues that have been uncovered during recent testing at
Mellanox.
Patch #1 has a v3.16+ stable tag, and #2-3 have v3.10+ stable tags"
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
iser-target: Fix possible use-after-free
iser-target: release stale iser connections
iser-target: Fix variable-length response error completion
+22
-3
+22
-3
drivers/infiniband/ulp/isert/ib_isert.c
+22
-3
drivers/infiniband/ulp/isert/ib_isert.c
···
65
65
isert_rdma_accept(struct isert_conn *isert_conn);
66
66
struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
67
67
68
+
static void isert_release_work(struct work_struct *work);
69
+
68
70
static inline bool
69
71
isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)
70
72
{
···
650
648
mutex_init(&isert_conn->mutex);
651
649
spin_lock_init(&isert_conn->pool_lock);
652
650
INIT_LIST_HEAD(&isert_conn->fr_pool);
651
+
INIT_WORK(&isert_conn->release_work, isert_release_work);
653
652
}
654
653
655
654
static void
···
928
925
{
929
926
struct isert_np *isert_np = cma_id->context;
930
927
struct isert_conn *isert_conn;
928
+
bool terminating = false;
931
929
932
930
if (isert_np->np_cm_id == cma_id)
933
931
return isert_np_cma_handler(cma_id->context, event);
···
936
932
isert_conn = cma_id->qp->qp_context;
937
933
938
934
mutex_lock(&isert_conn->mutex);
935
+
terminating = (isert_conn->state == ISER_CONN_TERMINATING);
939
936
isert_conn_terminate(isert_conn);
940
937
mutex_unlock(&isert_conn->mutex);
941
938
942
939
isert_info("conn %p completing wait\n", isert_conn);
943
940
complete(&isert_conn->wait);
944
941
942
+
if (terminating)
943
+
goto out;
944
+
945
+
mutex_lock(&isert_np->np_accept_mutex);
946
+
if (!list_empty(&isert_conn->accept_node)) {
947
+
list_del_init(&isert_conn->accept_node);
948
+
isert_put_conn(isert_conn);
949
+
queue_work(isert_release_wq, &isert_conn->release_work);
950
+
}
951
+
mutex_unlock(&isert_np->np_accept_mutex);
952
+
953
+
out:
945
954
return 0;
946
955
}
947
956
···
2397
2380
page_off = offset % PAGE_SIZE;
2398
2381
2399
2382
send_wr->sg_list = ib_sge;
2400
-
send_wr->num_sge = sg_nents;
2401
2383
send_wr->wr_id = (uintptr_t)&isert_cmd->tx_desc;
2402
2384
/*
2403
2385
* Perform mapping of TCM scatterlist memory ib_sge dma_addr.
···
2416
2400
ib_sge->addr, ib_sge->length, ib_sge->lkey);
2417
2401
page_off = 0;
2418
2402
data_left -= ib_sge->length;
2403
+
if (!data_left)
2404
+
break;
2419
2405
ib_sge++;
2420
2406
isert_dbg("Incrementing ib_sge pointer to %p\n", ib_sge);
2421
2407
}
2422
2408
2409
+
send_wr->num_sge = ++i;
2423
2410
isert_dbg("Set outgoing sg_list: %p num_sg: %u from TCM SGLs\n",
2424
2411
send_wr->sg_list, send_wr->num_sge);
2425
2412
2426
-
return sg_nents;
2413
+
return send_wr->num_sge;
2427
2414
}
2428
2415
2429
2416
static int
···
3385
3366
isert_wait4flush(isert_conn);
3386
3367
isert_wait4logout(isert_conn);
3387
3368
3388
-
INIT_WORK(&isert_conn->release_work, isert_release_work);
3389
3369
queue_work(isert_release_wq, &isert_conn->release_work);
3390
3370
}
3391
3371
···
3392
3374
{
3393
3375
struct isert_conn *isert_conn = conn->context;
3394
3376
3377
+
isert_wait4flush(isert_conn);
3395
3378
isert_put_conn(isert_conn);
3396
3379
}
3397
3380