Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull SCSI target fixes from Nicholas Bellinger:
"Here are the target-pending fixes for v4.12-rc7 that have been queued
up for the last 2 weeks. This includes:
- Fix a TMR related kref underflow detected by the recent refcount_t
conversion in upstream.
- Fix a iscsi-target corner case during explicit connection logout
timeout failure.
- Address last fallout in iscsi-target immediate data handling from
v4.4 target-core now allowing control CDB payload underflow"
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
iscsi-target: Reject immediate data underflow larger than SCSI transfer length
iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP
target: Fix kref->refcount underflow in transport_cmd_finish_abort
+35
-14
+20
-2
drivers/target/iscsi/iscsi_target.c
+20
-2
drivers/target/iscsi/iscsi_target.c
···
1279
1279
*/
1280
1280
if (dump_payload)
1281
1281
goto after_immediate_data;
1282
+
/*
1283
+
* Check for underflow case where both EDTL and immediate data payload
1284
+
* exceeds what is presented by CDB's TRANSFER LENGTH, and what has
1285
+
* already been set in target_cmd_size_check() as se_cmd->data_length.
1286
+
*
1287
+
* For this special case, fail the command and dump the immediate data
1288
+
* payload.
1289
+
*/
1290
+
if (cmd->first_burst_len > cmd->se_cmd.data_length) {
1291
+
cmd->sense_reason = TCM_INVALID_CDB_FIELD;
1292
+
goto after_immediate_data;
1293
+
}
1282
1294
1283
1295
immed_ret = iscsit_handle_immediate_data(cmd, hdr,
1284
1296
cmd->first_burst_len);
···
4435
4423
* always sleep waiting for RX/TX thread shutdown to complete
4436
4424
* within iscsit_close_connection().
4437
4425
*/
4438
-
if (!conn->conn_transport->rdma_shutdown)
4426
+
if (!conn->conn_transport->rdma_shutdown) {
4439
4427
sleep = cmpxchg(&conn->tx_thread_active, true, false);
4428
+
if (!sleep)
4429
+
return;
4430
+
}
4440
4431
4441
4432
atomic_set(&conn->conn_logout_remove, 0);
4442
4433
complete(&conn->conn_logout_comp);
···
4455
4440
{
4456
4441
int sleep = 1;
4457
4442
4458
-
if (!conn->conn_transport->rdma_shutdown)
4443
+
if (!conn->conn_transport->rdma_shutdown) {
4459
4444
sleep = cmpxchg(&conn->tx_thread_active, true, false);
4445
+
if (!sleep)
4446
+
return;
4447
+
}
4460
4448
4461
4449
atomic_set(&conn->conn_logout_remove, 0);
4462
4450
complete(&conn->conn_logout_comp);
+1
-1
drivers/target/target_core_internal.h
+1
-1
drivers/target/target_core_internal.h
···
136
136
void release_se_kmem_caches(void);
137
137
u32 scsi_get_new_index(scsi_index_t);
138
138
void transport_subsystem_check_init(void);
139
-
void transport_cmd_finish_abort(struct se_cmd *, int);
139
+
int transport_cmd_finish_abort(struct se_cmd *, int);
140
140
unsigned char *transport_dump_cmd_direction(struct se_cmd *);
141
141
void transport_dump_dev_state(struct se_device *, char *, int *);
142
142
void transport_dump_dev_info(struct se_device *, struct se_lun *,
+8
-8
drivers/target/target_core_tmr.c
+8
-8
drivers/target/target_core_tmr.c
···
75
75
kfree(tmr);
76
76
}
77
77
78
-
static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
78
+
static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
79
79
{
80
80
unsigned long flags;
81
81
bool remove = true, send_tas;
···
91
91
transport_send_task_abort(cmd);
92
92
}
93
93
94
-
transport_cmd_finish_abort(cmd, remove);
94
+
return transport_cmd_finish_abort(cmd, remove);
95
95
}
96
96
97
97
static int target_check_cdb_and_preempt(struct list_head *list,
···
184
184
cancel_work_sync(&se_cmd->work);
185
185
transport_wait_for_tasks(se_cmd);
186
186
187
-
transport_cmd_finish_abort(se_cmd, true);
188
-
target_put_sess_cmd(se_cmd);
187
+
if (!transport_cmd_finish_abort(se_cmd, true))
188
+
target_put_sess_cmd(se_cmd);
189
189
190
190
printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
191
191
" ref_tag: %llu\n", ref_tag);
···
281
281
cancel_work_sync(&cmd->work);
282
282
transport_wait_for_tasks(cmd);
283
283
284
-
transport_cmd_finish_abort(cmd, 1);
285
-
target_put_sess_cmd(cmd);
284
+
if (!transport_cmd_finish_abort(cmd, 1))
285
+
target_put_sess_cmd(cmd);
286
286
}
287
287
}
288
288
···
380
380
cancel_work_sync(&cmd->work);
381
381
transport_wait_for_tasks(cmd);
382
382
383
-
core_tmr_handle_tas_abort(cmd, tas);
384
-
target_put_sess_cmd(cmd);
383
+
if (!core_tmr_handle_tas_abort(cmd, tas))
384
+
target_put_sess_cmd(cmd);
385
385
}
386
386
}
387
387
+6
-3
drivers/target/target_core_transport.c
+6
-3
drivers/target/target_core_transport.c
···
651
651
percpu_ref_put(&lun->lun_ref);
652
652
}
653
653
654
-
void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
654
+
int transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
655
655
{
656
656
bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
657
+
int ret = 0;
657
658
658
659
if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
659
660
transport_lun_remove_cmd(cmd);
···
666
665
cmd->se_tfo->aborted_task(cmd);
667
666
668
667
if (transport_cmd_check_stop_to_fabric(cmd))
669
-
return;
668
+
return 1;
670
669
if (remove && ack_kref)
671
-
transport_put_cmd(cmd);
670
+
ret = transport_put_cmd(cmd);
671
+
672
+
return ret;
672
673
}
673
674
674
675
static void target_complete_failure_work(struct work_struct *work)