15 Feb, 2017
5 commits
-
commit 9b2792c3da1e80f2d460167d319302a24c9ca2b7 upstream.
This patch addresses a long standing bug where the commit phase
of COMPARE_AND_WRITE would result in a se_cmd->cmd_kref reference
leak if se_cmd->scsi_status returned non SAM_STAT_GOOD.This would manifest first as a lost SCSI response, and eventual
hung task during fabric driver logout or re-login, as existing
shutdown logic waited for the COMPARE_AND_WRITE se_cmd->cmd_kref
to reach zero.To address this bug, compare_and_write_post() has been changed
to drop the incorrect !cmd->scsi_status conditional that was
preventing *post_ret = 1 for being set during non SAM_STAT_GOOD
status.This patch has been tested with SAM_STAT_CHECK_CONDITION status
from normal target_complete_cmd() callback path, as well as the
incoming __target_execute_cmd() submission failure path when
se_cmd->execute_cmd() returns non zero status.Reported-by: Donald White
Cc: Donald White
Tested-by: Gary Guo
Cc: Gary Guo
Reviewed-by: Christoph Hellwig
Signed-off-by: Nicholas Bellinger
Signed-off-by: Greg Kroah-Hartman -
commit 01d4d673558985d9a118e1e05026633c3e2ade9b upstream.
This patch addresses a long-standing bug with multi-session
(eg: iscsi-target + iser-target) se_node_acl dynamic free
withini transport_deregister_session().This bug is caused when a storage endpoint is configured with
demo-mode (generate_node_acls = 1 + cache_dynamic_acls = 1)
initiators, and initiator login creates a new dynamic node acl
and attaches two sessions to it.After that, demo-mode for the storage instance is disabled via
configfs (generate_node_acls = 0 + cache_dynamic_acls = 0) and
the existing dynamic acl is never converted to an explicit ACL.The end result is dynamic acl resources are released twice when
the sessions are shutdown in transport_deregister_session().If the storage instance is not changed to disable demo-mode,
or the dynamic acl is converted to an explict ACL, or there
is only a single session associated with the dynamic ACL,
the bug is not triggered.To address this big, move the release of dynamic se_node_acl
memory into target_complete_nacl() so it's only freed once
when se_node_acl->acl_kref reaches zero.(Drop unnecessary list_del_init usage - HCH)
Reported-by: Rob Millner
Tested-by: Rob Millner
Cc: Rob Millner
Signed-off-by: Nicholas Bellinger
Signed-off-by: Greg Kroah-Hartman -
commit c54eeffbe9338fa982dc853d816fda9202a13b5a upstream.
This patch fixes a bug where incoming task management requests
can be explicitly aborted during an active LUN_RESET, but who's
struct work_struct are canceled in-flight before execution.This occurs when core_tmr_drain_tmr_list() invokes cancel_work_sync()
for the incoming se_tmr_req->task_cmd->work, resulting in cmd->work
for target_tmr_work() never getting invoked and the aborted TMR
waiting indefinately within transport_wait_for_tasks().To address this case, perform a CMD_T_ABORTED check early in
transport_generic_handle_tmr(), and invoke the normal path via
transport_cmd_check_stop_to_fabric() to complete any TMR kthreads
blocked waiting for CMD_T_STOP in transport_wait_for_tasks().Also, move the TRANSPORT_ISTATE_PROCESSING assignment earlier
into transport_generic_handle_tmr() so the existing check in
core_tmr_drain_tmr_list() avoids attempting abort the incoming
se_tmr_req->task_cmd->work if it has already been queued into
se_device->tmr_wq.Reported-by: Rob Millner
Tested-by: Rob Millner
Cc: Rob Millner
Reviewed-by: Christoph Hellwig
Signed-off-by: Nicholas Bellinger
Signed-off-by: Greg Kroah-Hartman -
commit 0583c261e6325f392c1f7a1b9112e31298e1a4bd upstream.
This patch adds the missing target_complete_cmd() SCSI status
parameter change in target_xcopy_do_work(), that was originally
missing in commit 926317de33.It correctly propigates up the correct SCSI status during
EXTENDED_COPY exception cases, instead of always using the
hardcoded SAM_STAT_CHECK_CONDITION from original code.This is required for ESX host environments that expect to
hit SAM_STAT_RESERVATION_CONFLICT for certain scenarios,
and SAM_STAT_CHECK_CONDITION results in non-retriable
status for these cases.Reported-by: Nixon Vincent
Tested-by: Nixon Vincent
Cc: Nixon Vincent
Reviewed-by: Christoph Hellwig
Signed-off-by: Nicholas Bellinger
Signed-off-by: Greg Kroah-Hartman -
commit 391e2a6de9781e4906dd7e0b1cc097050bf43e11 upstream.
After the v4.2+ RCU conversion to se_node_acl->lun_entry_hlist,
a BUG_ON() was added in core_enable_device_list_for_node() to
detect when the located orig->se_lun_acl contains an existing
se_lun_acl pointer reference.However, this scenario can happen when a dynamically generated
NodeACL is being converted to an explicit NodeACL, when the
explicit NodeACL contains a different LUN mapping than the
default provided by the WWN endpoint.So instead of triggering BUG_ON(), go ahead and fail instead
following the original pre RCU conversion logic.Reported-by: Benjamin ESTRABAUD
Cc: Benjamin ESTRABAUD
Reviewed-by: Christoph Hellwig
Signed-off-by: Nicholas Bellinger
Signed-off-by: Greg Kroah-Hartman
12 Jan, 2017
2 commits
-
commit 8456066a57940b3884aa080c58b166567dc9de39 upstream.
Pass a task state as second argument to percpu_ida_alloc().
Fixes: commit 5a3ee221b543 ("sbp-target: Conversion to percpu_ida tag pre-allocation")
Signed-off-by: Bart Van Assche
Cc: Chris Boot
Signed-off-by: Greg Kroah-Hartman -
commit a91918cd3ea11f91c68e08e1e8ce1b560447a80e upstream.
This iscsit_tpg_add_portal_group() function is only called from
lio_target_tiqn_addtpg(). Both functions free the "tpg" pointer on
error so it's a double free bug. The memory is allocated in the caller
so it should be freed in the caller and not here.Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Signed-off-by: Dan Carpenter
Reviewed-by: David Disseldorp
[ bvanassche: Added "Fix" at start of patch title ]
Signed-off-by: Bart Van Assche
Signed-off-by: Greg Kroah-Hartman
09 Jan, 2017
2 commits
-
commit d0905ca757bc40bd1ebc261a448a521b064777d7 upstream.
Don't free the cmd in tcmu_check_expired_cmd, it's still referenced by
an entry in our cmd_id->cmd idr. If userspace ever resumes processing,
tcmu_handle_completions() will use the now-invalid cmd pointer.Instead, don't free cmd. It will be freed by tcmu_handle_completion() if
userspace ever recovers, or tcmu_free_device if not.Reported-by: Bryant G Ly
Tested-by: Bryant G Ly
Signed-off-by: Andy Grover
Signed-off-by: Bart Van Assche
Signed-off-by: Greg Kroah-Hartman -
commit 83337e544323a8bd7492994d64af339175ac7107 upstream.
If iscsit_tpg_add_network_portal() fails then
return error code instead of 0 to user space.If iscsi-target returns 0 then user space keeps
on retrying same command infinitely, targetcli or
echo hangs till command completes with non zero
return value. In some cases it is possible that
add network portal command never completes with
success even after retrying multiple times,
for example - cxgbit_setup_np() always returns
-EINVAL if portal IP does not belong to Chelsio
adapter interface.Signed-off-by: Varun Prakash
Signed-off-by: Bart Van Assche
[ bvanassche: Added "Fixes:" and "Cc: stable" tags ]
Fixes: commit d4b3fa4b0881 ("iscsi-target: Make iscsi_tpg_np driver show/store use generic code")
Signed-off-by: Greg Kroah-Hartman
21 Oct, 2016
5 commits
-
The libfc stack assigns exchange IDs based on the CPU the request
was received on, so we need to send the responses via the same CPU.
Otherwise the send logic gets confuses and responses will be delayed,
causing exchange timeouts on the initiator side.Signed-off-by: Hannes Reinecke
Cc: stable@vger.kernel.org # 4.5+
Signed-off-by: Nicholas Bellinger -
Update the debug statements to match those from libfc.
Signed-off-by: Hannes Reinecke
Signed-off-by: Nicholas Bellinger -
Not every failure is due to out-of-memory; the ACLs might not be
set, too. So return a detailed error code in ft_sess_create()
instead of just a NULL pointer.Signed-off-by: Hannes Reinecke
Signed-off-by: Nicholas Bellinger -
When allocating a new command we should add the pointer to the
debug statements; that allows us to match this with other debug
statements for handling data.Signed-off-by: Hannes Reinecke
Signed-off-by: Nicholas Bellinger -
target_sess_cmd_list_waiting() might hit on a condition where
the kref for the command is already 0, but the destructor has
not been called yet (or is stuck in waiting for a spin lock).
Rather than leaving the command on the list we should explicitly
remove it to avoid race issues later on.Signed-off-by: Hannes Reinecke
Signed-off-by: Nicholas Bellinger
20 Oct, 2016
9 commits
-
This reverts commit c1ccbfe0311e2380a6d2dcb0714b36904f5d586f.
Reverting this patch, as it incorrectly assumes the additional length
for INQUIRY in target_complete_cmd_with_length() is SCSI allocation
length, which breaks existing user-space code when SCSI allocation
length is smaller than additional length.root@scsi-mq:~# sg_inq --len=4 -vvvv /dev/sdb
found bsg_major=253
open /dev/sdb with flags=0x800
inquiry cdb: 12 00 00 00 04 00
duration=0 ms
inquiry: pass-through requested 4 bytes (data-in) but got -28 bytes
inquiry: pass-through can't get negative bytes, say it got none
inquiry: got too few bytes (0)
INQUIRY resid (32) should never exceed requested len=4
inquiry: failed requesting 4 byte response: Malformed response to
SCSI command [resid=32]AFAICT the original change was not to address a specific host issue,
so go ahead and revert to original logic for now.Cc: Douglas Gilbert
Cc: Martin K. Petersen
Cc: Sumit Rai
Cc: stable@vger.kernel.org # 4.8+
Signed-off-by: Nicholas Bellinger -
This patch addresses a bug where a local EXTENDED_COPY WRITE or READ
backend I/O request would always return SAM_STAT_CHECK_CONDITION,
even if underlying xcopy_pt_cmd->se_cmd generated a different
SCSI status code.ESX host environments expect to hit SAM_STAT_RESERVATION_CONFLICT
for certain scenarios, and SAM_STAT_CHECK_CONDITION results in
non-retriable status for these cases.Tested on v4.1.y with ESX v5.5u2+ with local IBLOCK backend copy.
Reported-by: Nixon Vincent
Tested-by: Nixon Vincent
Cc: Nixon Vincent
Tested-by: Dinesh Israni
Signed-off-by: Dinesh Israni
Cc: Dinesh Israni
Cc: stable@vger.kernel.org # 3.14+
Signed-off-by: Nicholas Bellinger -
This patch addresses a bug where EXTENDED_COPY across multiple LUNs
results in a CHECK_CONDITION when the source + destination are not
located on the same physical node.ESX Host environments expect sense COPY_ABORTED w/ COPY TARGET DEVICE
NOT REACHABLE to be returned when this occurs, in order to signal
fallback to local copy method.As described in section 6.3.3 of spc4r22:
"If it is not possible to complete processing of a segment because the
copy manager is unable to establish communications with a copy target
device, because the copy target device does not respond to INQUIRY,
or because the data returned in response to INQUIRY indicates
an unsupported logical unit, then the EXTENDED COPY command shall be
terminated with CHECK CONDITION status, with the sense key set to
COPY ABORTED, and the additional sense code set to COPY TARGET DEVICE
NOT REACHABLE."Tested on v4.1.y with ESX v5.5u2+ with BlockCopy across multiple nodes.
Reported-by: Nixon Vincent
Tested-by: Nixon Vincent
Cc: Nixon Vincent
Tested-by: Dinesh Israni
Signed-off-by: Dinesh Israni
Cc: Dinesh Israni
Cc: stable@vger.kernel.org # 3.14+
Signed-off-by: Nicholas Bellinger -
This patch fixes a regression in >= v4.1.y code where the original
SCF_ACK_KREF assignment in target_get_sess_cmd() was dropped upstream
in commit 054922bb, but the series for addressing TMR ABORT_TASK +
LUN_RESET with fabric session reinstatement in commit febe562c20 still
depends on this code in transport_cmd_finish_abort().The regression manifests itself as a se_cmd->cmd_kref +1 leak, where
ABORT_TASK + LUN_RESET can hang indefinately for a specific I_T session
for drivers using SCF_ACK_KREF, resulting in hung kthreads.This patch has been verified with v4.1.y code.
Reported-by: Vaibhav Tandon
Tested-by: Vaibhav Tandon
Cc: Vaibhav Tandon
Cc: stable@vger.kernel.org # 4.1+
Signed-off-by: Nicholas Bellinger -
If iscsi-target receives NOP OUT with ITT and TTT
set to 0xffffffff it allocates iscsi_cmd but
does not free the cmd, so free iscsi_cmd in this case.Signed-off-by: Varun Prakash
Signed-off-by: Nicholas Bellinger -
Trivial fix to spelling mistakes in pr_debug message and comments
Signed-off-by: Colin Ian King
Reviewed-by: Bart Van Assche
Signed-off-by: Nicholas Bellinger -
We no longer use a ringbuffer for the data area, so this might cause
confusion. Just call it the data area.Signed-off-by: Andy Grover
Reviewed-by: Christoph Hellwig
Reviewed-by: Mike Christie
Signed-off-by: Nicholas Bellinger -
Userspace should be implementing VPD B0 (Block Limits) to inform the
initiator of max data size, but just in case we do get a too-large request,
do what the spec says and return INVALID_CDB_FIELD.Make sure to unlock udev->cmdr_lock before returning.
Signed-off-by: Andy Grover
Reviewed-by: Christoph Hellwig
Reviewed-by: Mike Christie
Signed-off-by: Nicholas Bellinger -
Instead of using -ERROR-style returns, use sense_reason_t. This lets us
remove tcmu_pass_op(), and return more correct sense values.Signed-off-by: Andy Grover
Signed-off-by: Bryant G. Ly
Reviewed-by: Christoph Hellwig
Reviewed-by: Mike Christie
Signed-off-by: Nicholas Bellinger
19 Sep, 2016
1 commit
-
Allocate resources dynamically to cxgb4's Upper layer driver's(ULD) like
cxgbit, iw_cxgb4 and cxgb4i. Allocate resources when they register with
cxgb4 driver and free them while unregistering. All the queues and the
interrupts for them will be allocated during ULD probe only and freed
during remove.Signed-off-by: Hariprasad Shenai
Signed-off-by: David S. Miller
16 Sep, 2016
11 commits
-
Add cxgb_mk_rx_data_ack() to remove duplicate
code to form CPL_RX_DATA_ACK hardware command.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_mk_abort_rpl() to remove duplicate
code to form CPL_ABORT_RPL hardware command.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_mk_abort_req() to remove duplicate code
to form CPL_ABORT_REQ hardware command.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_mk_close_con_req() to remove duplicate
code to form CPL_CLOSE_CON_REQ hardware command.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_mk_tid_release() to remove duplicate code
to form CPL_TID_RELEASE hardware command.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_compute_wscale() in libcxgb_cm.h to remove
it's duplicate definitions from cxgb4/cm.c and
cxgbit/cxgbit_cm.c.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_best_mtu() in libcxgb_cm.h to remove
it's duplicate definitions from cxgb4/cm.c and
cxgbit/cxgbit_cm.cSigned-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_is_neg_adv() in libcxgb_cm.h to remove
it's duplicate definitions from cxgb4/cm.c and
cxgbit/cxgbit_cm.c.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_find_route6() in libcxgb_cm.c to remove
it's duplicate definitions from cxgb4/cm.c and
cxgbit/cxgbit_cm.c.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_find_route() in libcxgb_cm.c to remove
it's duplicate definitions from cxgb4/cm.c and
cxgbit/cxgbit_cm.c.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller -
Add cxgb_get_4tuple() in libcxgb_cm.c to remove
it's duplicate definitions from cxgb4/cm.c and
cxgbit/cxgbit_cm.c.Signed-off-by: Varun Prakash
Signed-off-by: David S. Miller
08 Aug, 2016
1 commit
-
The original commit missed this function, it needs to mark it a
write flush.Cc: Mike Christie
Fixes: e742fc32fcb4 ("target: use bio op accessors")
Signed-off-by: Jens Axboe
05 Aug, 2016
1 commit
-
Pull SCSI target updates from Nicholas Bellinger:
"The most notable item is IBM virtual SCSI target driver, that was
originally ported to target-core back in 2010 by Tomo-san, and has
been brought forward to v4.x code by Bryant Ly, Michael Cyr and co
over the last months.Also included are two ORDERED task related bug-fixes Bryant + Michael
found along the way using ibmvscsis with AIX guests, plus a few
miscellaneous target-core + iscsi-target bug-fixes with associated
stable tags"* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
target: fix spelling mistake: "limitiation" -> "limitation"
target: Fix residual overflow handling in target_complete_cmd_with_length
tcm_fc: set and unset FCP_SPPF_TARG_FCN
iscsi-target: Fix panic when adding second TCP connection to iSCSI session
ibmvscsis: Initial commit of IBM VSCSI Tgt Driver
target: Fix ordered task CHECK_CONDITION early exception handling
target: Fix ordered task target_setup_cmd_from_cdb exception hang
target: Fix max_unmap_lba_count calc overflow
target: Fix race between iscsi-target connection shutdown + ABORT_TASK
target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP
28 Jul, 2016
1 commit
-
Pull networking updates from David Miller:
1) Unified UDP encapsulation offload methods for drivers, from
Alexander Duyck.2) Make DSA binding more sane, from Andrew Lunn.
3) Support QCA9888 chips in ath10k, from Anilkumar Kolli.
4) Several workqueue usage cleanups, from Bhaktipriya Shridhar.
5) Add XDP (eXpress Data Path), essentially running BPF programs on RX
packets as soon as the device sees them, with the option to mirror
the packet on TX via the same interface. From Brenden Blanco and
others.6) Allow qdisc/class stats dumps to run lockless, from Eric Dumazet.
7) Add VLAN support to b53 and bcm_sf2, from Florian Fainelli.
8) Simplify netlink conntrack entry layout, from Florian Westphal.
9) Add ipv4 forwarding support to mlxsw spectrum driver, from Ido
Schimmel, Yotam Gigi, and Jiri Pirko.10) Add SKB array infrastructure and convert tun and macvtap over to it.
From Michael S Tsirkin and Jason Wang.11) Support qdisc packet injection in pktgen, from John Fastabend.
12) Add neighbour monitoring framework to TIPC, from Jon Paul Maloy.
13) Add NV congestion control support to TCP, from Lawrence Brakmo.
14) Add GSO support to SCTP, from Marcelo Ricardo Leitner.
15) Allow GRO and RPS to function on macsec devices, from Paolo Abeni.
16) Support MPLS over IPV4, from Simon Horman.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1622 commits)
xgene: Fix build warning with ACPI disabled.
be2net: perform temperature query in adapter regardless of its interface state
l2tp: Correctly return -EBADF from pppol2tp_getname.
net/mlx5_core/health: Remove deprecated create_singlethread_workqueue
net: ipmr/ip6mr: update lastuse on entry change
macsec: ensure rx_sa is set when validation is disabled
tipc: dump monitor attributes
tipc: add a function to get the bearer name
tipc: get monitor threshold for the cluster
tipc: make cluster size threshold for monitoring configurable
tipc: introduce constants for tipc address validation
net: neigh: disallow transition to NUD_STALE if lladdr is unchanged in neigh_update()
MAINTAINERS: xgene: Add driver and documentation path
Documentation: dtb: xgene: Add MDIO node
dtb: xgene: Add MDIO node
drivers: net: xgene: ethtool: Use phy_ethtool_gset and sset
drivers: net: xgene: Use exported functions
drivers: net: xgene: Enable MDIO driver
drivers: net: xgene: Add backward compatibility
drivers: net: phy: xgene: Add MDIO driver
...
26 Jul, 2016
2 commits
-
Export cxgbi_ppm_release() to release
ppod manager and cxgbi_tagmask_set() to
set tag mask, they are used by cxgb3i, cxgb4i
and cxgbit.Signed-off-by: Varun Prakash
Reviewed-by: Steve Wise
Signed-off-by: David S. Miller -
Add common library module(libcxgb.ko) for
Chelsio drivers to remove duplicate code.Code for iSCSI DDP Page Pod Manager is moved
from cxgb4.ko to libcxgb.ko. Earlier only cxgbit.ko
was using this code, now cxgb3i and cxgb4i will
also use common Page Pod manager code.In future this module will have common connection
management and hardware specific code that can be
shared by multiple Chelsio drivers.Signed-off-by: Varun Prakash
Reviewed-by: Steve Wise
Signed-off-by: David S. Miller