25 Mar, 2015

7 commits

  • Rusty pointed out that the module license should be "GPL v2" to properly
    match the notice at the top of the files, so make that change.

    Reported-by: Rusty Russell
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     
  • Use kstrtoint function instead of sscanf and check for return values.

    Signed-off-by: Rastislav Barlik
    Signed-off-by: Greg Kroah-Hartman

    Rastislav Barlik
     
  • It is not necessary to call device_remove_groups() when device_add_groups()
    fails.

    The group added by device_add_groups() should be removed if sysfs_create_link()
    fails.

    Fixes: fa6fdb33b486 ("driver core: bus_type: add dev_groups")
    Signed-off-by: Junjie Mao
    Signed-off-by: Greg Kroah-Hartman

    Junjie Mao
     
  • There are series of comparisons of the 'ret' variable on the failure path of
    really_probe(), so the *switch* statement seems more appropriate there.

    Signed-off-by: Sergei Shtylyov
    Signed-off-by: Greg Kroah-Hartman

    Sergei Shtylyov
     
  • Document variables defined in struct attribute_group to ensure
    correct usage.

    Signed-off-by: Guenter Roeck
    Signed-off-by: Vivien Didelot
    Signed-off-by: Greg Kroah-Hartman

    Guenter Roeck
     
  • For sysfs file attributes, only read and write permissions make sense.
    Mask provided attribute permissions accordingly and send a warning
    to the console if invalid permission bits are set.

    This patch is originally from Guenter [1] and includes the fixup
    explained in the thread, that is printing permissions in octal format
    and limiting the scope of attributes to SYSFS_PREALLOC | 0664.

    [1] https://lkml.org/lkml/2015/1/19/599

    Signed-off-by: Vivien Didelot
    Reviewed-by: Guenter Roeck
    Signed-off-by: Greg Kroah-Hartman

    Vivien Didelot
     
  • Up to now, is_visible can only be used to either remove visibility
    of a file entirely or to add permissions, but not to reduce permissions.
    This makes it impossible, for example, to use DEVICE_ATTR_RW to define
    file attributes and reduce permissions to read-only.

    This behavior is undesirable and unnecessarily complicates code which
    needs to reduce permissions; instead of just returning the desired
    permissions, it has to ensure that the permissions in the attribute
    variable declaration only reflect the minimal permissions ever needed.

    Change semantics of is_visible to only use the permissions returned
    from it instead of oring the returned value with the hard-coded
    permissions.

    Signed-off-by: Guenter Roeck
    Signed-off-by: Vivien Didelot
    Signed-off-by: Greg Kroah-Hartman

    Guenter Roeck
     

23 Mar, 2015

7 commits

  • Linus Torvalds
     
  • Pull bugfix for md from Neil Brown:
    "One fix for md in 4.0-rc4

    Regression in recent patch causes crash on error path"

    * tag 'md/4.0-rc4-fix' of git://neil.brown.name/md:
    md: fix problems with freeing private data after ->run failure.

    Linus Torvalds
     
  • Pull driver core fixes from Greg KH:
    "Here are two bugfixes for things reported. One regression in kernfs,
    and another issue fixed in the LZ4 code that was fixed in the
    "upstream" codebase that solves a reported kernel crash

    Both have been in linux-next for a while"

    * tag 'driver-core-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
    LZ4 : fix the data abort issue
    kernfs: handle poll correctly on 'direct_read' files.

    Linus Torvalds
     
  • Pull char/misc fixes from Greg KH:
    "Here are three fixes for 4.0-rc5 that revert 3 PCMCIA patches that
    were merged in 4.0-rc1 that cause regressions. So let's revert them
    for now and they will be reworked and resent sometime in the future.

    All have been tested in linux-next for a while"

    * tag 'char-misc-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
    Revert "pcmcia: add a new resource manager for non ISA systems"
    Revert "pcmcia: fix incorrect bracketing on a test"
    Revert "pcmcia: add missing include for new pci resource handler"

    Linus Torvalds
     
  • Pull staging driver fixes from Greg KH:
    "Here are four small staging driver fixes, all for the vt6656 and
    vt6655 drivers, that resolve some reported issues with them.

    All of these patches have been in linux next for a while"

    * tag 'staging-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    vt6655: Fix late setting of byRFType.
    vt6655: RFbSetPower fix missing rate RATE_12M
    staging: vt6656: vnt_rf_setpower: fix missing rate RATE_12M
    staging: vt6655: vnt_tx_packet fix dma_idx selection.

    Linus Torvalds
     
  • Pull tty/serial driver fix from Greg KH:
    "Here's a single 8250 serial driver that fixes a reported deadlock with
    the serial console and the tty driver.

    It's been in linux-next for a while now"

    * tag 'tty-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    serial: 8250_dw: Fix deadlock in LCR workaround

    Linus Torvalds
     
  • Pull USB / PHY driver fixes from Greg KH:
    "Here's a number of USB and PHY driver fixes for 4.0-rc5.

    The largest thing here is a revert of a gadget function driver patch
    that removes 500 lines of code. Other than that, it's a number of
    reported bugs fixes and new quirk/id entries.

    All have been in linux-next for a while"

    * tag 'usb-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (33 commits)
    usb: common: otg-fsm: only signal connect after switching to peripheral
    uas: Add US_FL_NO_ATA_1X for Initio Corporation controllers / devices
    USB: ehci-atmel: rework clk handling
    MAINTAINERS: add entry for USB OTG FSM
    usb: chipidea: otg: add a_alt_hnp_support response for B device
    phy: omap-usb2: Fix missing clk_prepare call when using old dt name
    phy: ti/omap: Fix modalias
    phy: core: Fixup return value of phy_exit when !pm_runtime_enabled
    phy: miphy28lp: Convert to devm_kcalloc and fix wrong sizof
    phy: miphy365x: Convert to devm_kcalloc and fix wrong sizeof
    phy: twl4030-usb: Remove redundant assignment for twl->linkstat
    phy: exynos5-usbdrd: Fix off-by-one valid value checking for args->args[0]
    phy: Find the right match in devm_phy_destroy()
    phy: rockchip-usb: Fixup rockchip_usb_phy_power_on failure path
    phy: ti-pipe3: Simplify ti_pipe3_dpll_wait_lock implementation
    phy: samsung-usb2: Remove NULL terminating entry from phys array
    phy: hix5hd2-sata: Check return value of platform_get_resource
    phy: exynos-dp-video: Kill exynos_dp_video_phy_pwr_isol function
    Revert "usb: gadget: zero: Add support for interrupt EP"
    Revert "xhci: Clear the host side toggle manually when endpoint is 'soft reset'"
    ...

    Linus Torvalds
     

22 Mar, 2015

11 commits

  • Pull slave dmaengine fixes from Vinod Koul:
    "Four fixes for dw, pl08x, imx-sdma and at_hdmac driver. Nothing
    unusual here, simple fixes to these drivers"

    * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
    dmaengine: pl08x: Define capabilities for generic capabilities reporting
    dmaengine: dw: append MODULE_ALIAS for platform driver
    dmaengine: imx-sdma: switch to dynamic context mode after script loaded
    dmaengine: at_hdmac: Fix calculation of the residual bytes

    Linus Torvalds
     
  • Pull power management and ACPI fixes from Rafael Wysocki:
    "These are fixes for recent regressions (PCI/ACPI resources and at91
    RTC locking), a stable-candidate powercap RAPL driver fix and two ARM
    cpuidle fixes (one stable-candidate too).

    Specifics:

    - Revert a recent PCI commit related to IRQ resources management that
    introduced a regression for drivers attempting to bind to devices
    whose previous drivers did not balance pci_enable_device() and
    pci_disable_device() as expected (Rafael J Wysocki).

    - Fix a deadlock in at91_rtc_interrupt() introduced by a typo in a
    recent commit related to wakeup interrupt handling (Dan Carpenter).

    - Allow the power capping RAPL (Running-Average Power Limit) driver
    to use different energy units for domains within one CPU package
    which is necessary to handle Intel Haswell EP processors correctly
    (Jacob Pan).

    - Improve the cpuidle mvebu driver's handling of Armada XP SoCs by
    updating the target residency and exit latency numbers for those
    chips (Sebastien Rannou).

    - Prevent the cpuidle mvebu driver from calling cpu_pm_enter() twice
    in a row before cpu_pm_exit() is called on the same CPU which
    breaks the core's assumptions regarding the usage of those
    functions (Gregory Clement)"

    * tag 'pm+acpi-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
    Revert "x86/PCI: Refine the way to release PCI IRQ resources"
    rtc: at91rm9200: double locking bug in at91_rtc_interrupt()
    powercap / RAPL: handle domains with different energy units
    cpuidle: mvebu: Update cpuidle thresholds for Armada XP SOCs
    cpuidle: mvebu: Fix the CPU PM notifier usage

    Linus Torvalds
     
  • Pull drm updates from Dave Airlie:
    "A bunch of fixes across drivers:

    radeon:
    disable two ended allocation for now, it breaks some stuff

    amdkfd:
    misc fixes

    nouveau:
    fix irq loop problem, add basic support for GM206 (new hw)

    i915:
    fix some WARNs people were seeing

    exynos:
    fix some iommu interactions causing boot failures"

    * git://people.freedesktop.org/~airlied/linux:
    drm/radeon: drop ttm two ended allocation
    drm/exynos: fix the initialization order in FIMD
    drm/exynos: fix typo config name correctly.
    drm/exynos: Check for NULL dereference of crtc
    drm/exynos: IS_ERR() vs NULL bug
    drm/exynos: remove unused files
    drm/i915: Make sure the primary plane is enabled before reading out the fb state
    drm/nouveau/bios: fix i2c table parsing for dcb 4.1
    drm/nouveau/device/gm100: Basic GM206 bring up (as copy of GM204)
    drm/nouveau/device: post write to NV_PMC_BOOT_1 when flipping endian switch
    drm/nouveau/gr/gf100: fix some accidental or'ing of buffer addresses
    drm/nouveau/fifo/nv04: remove the loop from the interrupt handler
    drm/radeon: Changing number of compute pipe lines
    drm/amdkfd: Fix SDMA queue init. in non-HWS mode
    drm/amdkfd: destroy mqd when destroying kernel queue
    drm/i915: Ensure plane->state->fb stays in sync with plane->fb

    Linus Torvalds
     
  • …/kernel/git/robh/linux

    Pull more DeviceTree fixes vfom Rob Herring:

    - revert setting stdout-path as preferred console. This caused
    regressions in PowerMACs and other systems.

    - yet another fix for stdout-path option parsing.

    - fix error path handling in of_irq_parse_one

    * tag 'devicetree-fixes-for-4.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
    Revert "of: Fix premature bootconsole disable with 'stdout-path'"
    of: handle both '/' and ':' in path strings
    of: unittest: Add option string test case with longer path
    of/irq: Fix of_irq_parse_one() returned error codes

    Linus Torvalds
     
  • Pull SCSI target fixes from Nicholas Bellinger:
    "Here are current target-pending fixes for v4.0-rc5 code that have made
    their way into the queue over the last weeks.

    The fixes this round include:

    - Fix long-standing iser-target logout bug related to early
    conn_logout_comp completion, resulting in iscsi_conn use-after-tree
    OOpsen. (Sagi + nab)

    - Fix long-standing tcm_fc bug in ft_invl_hw_context() failure
    handing for DDP hw offload. (DanC)

    - Fix incorrect use of unprotected __transport_register_session() in
    tcm_qla2xxx + other single local se_node_acl fabrics. (Bart)

    - Fix reference leak in target_submit_cmd() -> target_get_sess_cmd()
    for ack_kref=1 failure path. (Bart)

    - Fix pSCSI backend ->get_device_type() statistics OOPs with
    un-configured device. (Olaf + nab)

    - Fix virtual LUN=0 target_configure_device failure OOPs at modprobe
    time. (Claudio + nab)

    - Fix FUA write false positive failure regression in v4.0-rc1 code.
    (Christophe Vu-Brugier + HCH)"

    * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
    target: do not reject FUA CDBs when write cache is enabled but emulate_write_cache is 0
    target: Fix virtual LUN=0 target_configure_device failure OOPs
    target/pscsi: Fix NULL pointer dereference in get_device_type
    tcm_fc: missing curly braces in ft_invl_hw_context()
    target: Fix reference leak in target_get_sess_cmd() error path
    loop/usb/vhost-scsi/xen-scsiback: Fix use of __transport_register_session
    tcm_qla2xxx: Fix incorrect use of __transport_register_session
    iscsi-target: Avoid early conn_logout_comp for iser connections
    Revert "iscsi-target: Avoid IN_LOGOUT failure case for iser-target"
    target: Disallow changing of WRITE cache/FUA attrs after export

    Linus Torvalds
     
  • Pull devicemapper fixes from Mike Snitzer:
    "A handful of stable fixes for DM:
    - fix thin target to always zero-fill reads to unprovisioned blocks
    - fix to interlock device destruction's suspend from internal
    suspends
    - fix 2 snapshot exception store handover bugs
    - fix dm-io to cope with DISCARD and WRITE_SAME capabilities changing"

    * tag 'dm-4.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
    dm io: deal with wandering queue limits when handling REQ_DISCARD and REQ_WRITE_SAME
    dm snapshot: suspend merging snapshot when doing exception handover
    dm snapshot: suspend origin when doing exception handover
    dm: hold suspend_lock while suspending device during device deletion
    dm thin: fix to consistently zero-fill reads to unprovisioned blocks

    Linus Torvalds
     
  • Pull btrfs fixes from Chris Mason:
    "Most of these are fixing extent reservation accounting, or corners
    with tree writeback during commit.

    Josef's set does add a test, which isn't strictly a fix, but it'll
    keep us from making this same mistake again"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
    Btrfs: fix outstanding_extents accounting in DIO
    Btrfs: add sanity test for outstanding_extents accounting
    Btrfs: just free dummy extent buffers
    Btrfs: account merges/splits properly
    Btrfs: prepare block group cache before writing
    Btrfs: fix ASSERT(list_empty(&cur_trans->dirty_bgs_list)
    Btrfs: account for the correct number of extents for delalloc reservations
    Btrfs: fix merge delalloc logic
    Btrfs: fix comp_oper to get right order
    Btrfs: catch transaction abortion after waiting for it
    btrfs: fix sizeof format specifier in btrfs_check_super_valid()

    Linus Torvalds
     
  • Pull nfsd bufix from Bruce Fields:
    "This is a fix for a crash easily triggered by 4.1 activity to a server
    built with CONFIG_NFSD_PNFS.

    There are some more bugfixes queued up that I intend to pass along
    next week, but this is the most critical"

    * 'for-4.0' of git://linux-nfs.org/~bfields/linux:
    Subject: nfsd: don't recursively call nfsd4_cb_layout_fail

    Linus Torvalds
     
  • Pull UBI fix from Artem Bityutskiy:
    "This fixes a bug introduced during the v4.0 merge window where we
    forgot to put braces where they should be"

    * tag 'upstream-4.0-rc5' of git://git.infradead.org/linux-ubifs:
    UBI: fix missing brace control flow

    Linus Torvalds
     
  • Pull arm64 fixes from Catalin Marinas:

    - mm switching fix where the kernel pgd ends up in the user TTBR0 after
    returning from an EFI run-time services call

    - fix __GFP_ZERO handling for atomic pool and CMA DMA allocations (the
    generic code does get the gfp flags, so it's left with the arch code
    to memzero accordingly)

    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
    arm64: Honor __GFP_ZERO in dma allocations
    arm64: efi: don't restore TTBR0 if active_mm points at init_mm

    Linus Torvalds
     
  • Pull ARM fixes from Russell King:
    "Another few ARM fixes. Fabrice fixed the L2 cache DT parsing to allow
    prefetch configuration to be specified even when the cache size
    parsing fails.

    Laura noticed that the setting of page attributes wasn't working for
    modules due to is_module_addr() always returning false.

    Marc Gonzalez (aka Mason) noticed a potential latent bug with the way
    we read one of the CPUID registers (where we could attempt to read a
    non-present CPUID register which may fault.)

    I've fixed an issue where 32-bit DMA masks were failing with memory
    which extended to the top of physical address space, and I've also
    added debugging output of the page tables when we hit a data access
    exception which we don't specifically handle - prompted by the lack of
    information in a bug report"

    * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
    ARM: 8313/1: Use read_cpuid_ext() macro instead of inline asm
    ARM: 8311/1: Don't use is_module_addr in setting page attributes
    ARM: 8310/1: l2c: Fix prefetch settings dt parsing
    ARM: dump pgd, pmd and pte states on unhandled data abort faults
    ARM: dma-api: fix off-by-one error in __dma_supported()

    Linus Torvalds
     

21 Mar, 2015

4 commits

  • * pm-cpuidle:
    cpuidle: mvebu: Update cpuidle thresholds for Armada XP SOCs
    cpuidle: mvebu: Fix the CPU PM notifier usage

    * powercap:
    powercap / RAPL: handle domains with different energy units

    * irq-pm:
    rtc: at91rm9200: double locking bug in at91_rtc_interrupt()

    * acpi-resources:
    Revert "x86/PCI: Refine the way to release PCI IRQ resources"

    Rafael J. Wysocki
     
  • If ->run() fails, it can either free the data structures it
    allocated, or leave that task to ->free() which will be called
    on failures.

    However:
    md.c calls ->free() even if ->private_data is NULL, which
    causes problems in some personalities.
    raid0.c frees the data, but doesn't clear ->private_data,
    which will become a problem when we fix md.c

    So better fix both these issues at once.

    Reported-by: Richard W.M. Jones
    Fixes: 5aa61f427e4979be733e4847b9199ff9cc48a47e
    URL: https://bugzilla.kernel.org/show_bug.cgi?id=94381
    Signed-off-by: NeilBrown

    NeilBrown
     
  • Current implementation doesn't zero out the pages allocated.
    Honor the __GFP_ZERO flag and zero out if set.

    Cc: # v3.14+
    Acked-by: Will Deacon
    Signed-off-by: Suzuki K. Poulose
    Signed-off-by: Catalin Marinas

    Suzuki K. Poulose
     
  • init_mm isn't a normal mm: it has swapper_pg_dir as its pgd (which
    contains kernel mappings) and is used as the active_mm for the idle
    thread.

    When restoring the pgd after an EFI call, we write current->active_mm
    into TTBR0. If the current task is actually the idle thread (e.g. when
    initialising the EFI RTC before entering userspace), then the TLB can
    erroneously populate itself with junk global entries as a result of
    speculative table walks.

    When we do eventually return to userspace, the task can end up hitting
    these junk mappings leading to lockups, corruption or crashes.

    This patch fixes the problem in the same way as the CPU suspend code by
    ensuring that we never switch to the init_mm in efi_set_pgd and instead
    point TTBR0 at the zero page. A check is also added to cpu_switch_mm to
    BUG if we get passed swapper_pg_dir.

    Reviewed-by: Ard Biesheuvel
    Fixes: f3cdfd239da5 ("arm64/efi: move SetVirtualAddressMap() to UEFI stub")
    Signed-off-by: Will Deacon
    Signed-off-by: Catalin Marinas

    Will Deacon
     

20 Mar, 2015

11 commits

  • Commit b4b55cda5874 (Refine the way to release PCI IRQ resources)
    introduced a regression in the PCI IRQ resource management by causing
    the IRQ resource of a device, established when pci_enabled_device()
    is called on a fully disabled device, to be released when the driver
    is unbound from the device, regardless of the enable_cnt.

    This leads to the situation that an ill-behaved driver can now make a
    device unusable to subsequent drivers by an imbalance in their use of
    pci_enable/disable_device(). That is a serious problem for secondary
    drivers like vfio-pci, which are innocent of the transgressions of
    the previous driver.

    Since the solution of this problem is not immediate and requires
    further discussion, revert commit b4b55cda5874 and the issue it was
    supposed to address (a bug related to xen-pciback) will be taken
    care of in a different way going forward.

    Reported-by: Alex Williamson
    Signed-off-by: Rafael J. Wysocki

    Rafael J. Wysocki
     
  • Backporting a couple of plane related fixes from drm-next to v4.0.

    * tag 'drm-intel-fixes-2015-03-19' of git://anongit.freedesktop.org/drm-intel:
    drm/i915: Make sure the primary plane is enabled before reading out the fb state
    drm/i915: Ensure plane->state->fb stays in sync with plane->fb

    Dave Airlie
     
  • …/linux into drm-fixes

    - Fixing SDMA initialization when in non-HWS mode (debug mode)
    - Memory leak fix when destroying kernel queue
    - Fix number of available compute pipelines according to new firmware

    * tag 'drm-amdkfd-fixes-2015-03-19' of git://people.freedesktop.org/~gabbayo/linux:
    drm/radeon: Changing number of compute pipe lines
    drm/amdkfd: Fix SDMA queue init. in non-HWS mode
    drm/amdkfd: destroy mqd when destroying kernel queue

    Dave Airlie
     
  • A check that rejects a CDB with FUA bit set if no write cache is
    emulated was added by the following commit:

    fde9f50 target: Add sanity checks for DPO/FUA bit usage

    The condition is as follows:

    if (!dev->dev_attrib.emulate_fua_write ||
    !dev->dev_attrib.emulate_write_cache)

    However, this check is wrong if the backend device supports WCE but
    "emulate_write_cache" is disabled.

    This patch uses se_dev_check_wce() (previously named
    spc_check_dev_wce) to invoke transport->get_write_cache() if the
    device has a write cache or check the "emulate_write_cache" attribute
    otherwise.

    Reported-by: Christoph Hellwig
    Signed-off-by: Christophe Vu-Brugier
    Signed-off-by: Nicholas Bellinger

    Christophe Vu-Brugier
     
  • This patch fixes a NULL pointer dereference triggered by a late
    target_configure_device() -> alloc_workqueue() failure that results
    in target_free_device() being called with DF_CONFIGURED already set,
    which subsequently OOPses in destroy_workqueue() code.

    Currently this only happens at modprobe target_core_mod time when
    core_dev_setup_virtual_lun0() -> target_configure_device() fails,
    and the explicit target_free_device() gets called.

    To address this bug originally introduced by commit 0fd97ccf45, go
    ahead and move DF_CONFIGURED to end of target_configure_device()
    code to handle this special failure case.

    Reported-by: Claudio Fleiner
    Cc: Claudio Fleiner
    Cc: Christoph Hellwig
    Cc: # v3.7+
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch fixes a NULL pointer dereference OOPs with pSCSI backends
    within target_core_stat.c code. The bug is caused by a configfs attr
    read if no pscsi_dev_virt->pdv_sd has been configured.

    Reported-by: Olaf Hering
    Cc:
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch adds a missing set of conditional check braces in
    ft_invl_hw_context() originally introduced by commit dcd998ccd
    when handling DDP failures in ft_recv_write_data() code.

    commit dcd998ccdbf74a7d8fe0f0a44e85da1ed5975946
    Author: Kiran Patil
    Date: Wed Aug 3 09:20:01 2011 +0000

    tcm_fc: Handle DDP/SW fc_frame_payload_get failures in ft_recv_write_data

    Signed-off-by: Dan Carpenter
    Cc: Kiran Patil
    Cc: # 3.1+
    Signed-off-by: Nicholas Bellinger

    Dan Carpenter
     
  • This patch fixes a se_cmd->cmd_kref leak buf when se_sess->sess_tearing_down
    is true within target_get_sess_cmd() submission path code.

    This se_cmd reference leak can occur during active session shutdown when
    ack_kref=1 is passed by target_submit_cmd_[map_sgls,tmr]() callers.

    Signed-off-by: Bart Van Assche
    Cc: # 3.6+
    Signed-off-by: Nicholas Bellinger

    Bart Van Assche
     
  • This patch changes loopback, usb-gadget, vhost-scsi and xen-scsiback
    fabric code to invoke transport_register_session() instead of the
    unprotected flavour, to ensure se_tpg->session_lock is taken when
    adding new session list nodes to se_tpg->tpg_sess_list.

    Note that since these four fabric drivers already hold their own
    internal TPG mutexes when accessing se_tpg->tpg_sess_list, and
    consist of a single se_session created through configfs attribute
    access, no list corruption can currently occur.

    So for correctness sake, go ahead and use the se_tpg->session_lock
    protected version for these four fabric drivers.

    Signed-off-by: Bart Van Assche
    Signed-off-by: Nicholas Bellinger

    Bart Van Assche
     
  • This patch fixes the incorrect use of __transport_register_session()
    in tcm_qla2xxx_check_initiator_node_acl() code, that does not perform
    explicit se_tpg->session_lock when accessing se_tpg->tpg_sess_list
    to add new se_sess nodes.

    Given that tcm_qla2xxx_check_initiator_node_acl() is not called with
    qla_hw->hardware_lock held for all accesses of ->tpg_sess_list, the
    code should be using transport_register_session() instead.

    Signed-off-by: Bart Van Assche
    Cc: Giridhar Malavali
    Cc: Quinn Tran
    Cc: # 3.5+
    Signed-off-by: Nicholas Bellinger

    Bart Van Assche
     
  • This patch fixes a iser specific logout bug where early complete()
    of conn->conn_logout_comp in iscsit_close_connection() was causing
    isert_wait4logout() to complete too soon, triggering a use after
    free NULL pointer dereference of iscsi_conn memory.

    The complete() was originally added for traditional iscsi-target
    when a ISCSI_LOGOUT_OP failed in iscsi_target_rx_opcode(), but given
    iser-target does not wait in logout failure, this special case needs
    to be avoided.

    Reported-by: Sagi Grimberg
    Cc: Sagi Grimberg
    Cc: Slava Shwartsman
    Cc: # v3.10+
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger