1. 08 4月, 2015 1 次提交
  2. 20 3月, 2015 1 次提交
    • N
      iscsi-target: Avoid early conn_logout_comp for iser connections · f068fbc8
      Nicholas Bellinger 提交于
      This patch fixes a iser specific logout bug where early complete()
      of conn->conn_logout_comp in iscsit_close_connection() was causing
      isert_wait4logout() to complete too soon, triggering a use after
      free NULL pointer dereference of iscsi_conn memory.
      
      The complete() was originally added for traditional iscsi-target
      when a ISCSI_LOGOUT_OP failed in iscsi_target_rx_opcode(), but given
      iser-target does not wait in logout failure, this special case needs
      to be avoided.
      Reported-by: NSagi Grimberg <sagig@mellanox.com>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Slava Shwartsman <valyushash@gmail.com>
      Cc: <stable@vger.kernel.org> # v3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      f068fbc8
  3. 13 2月, 2015 1 次提交
  4. 05 2月, 2015 2 次提交
  5. 31 1月, 2015 1 次提交
  6. 10 1月, 2015 1 次提交
  7. 04 12月, 2014 1 次提交
  8. 02 12月, 2014 1 次提交
  9. 29 10月, 2014 1 次提交
  10. 18 9月, 2014 2 次提交
  11. 28 6月, 2014 1 次提交
  12. 12 6月, 2014 1 次提交
  13. 10 6月, 2014 1 次提交
    • N
      iscsi-target: Fix ABORT_TASK + connection reset iscsi_queue_req memory leak · bbc05048
      Nicholas Bellinger 提交于
      This patch fixes a iscsi_queue_req memory leak when ABORT_TASK response
      has been queued by TFO->queue_tm_rsp() -> lio_queue_tm_rsp() after a
      long standing I/O completes, but the connection has already reset and
      waiting for cleanup to complete in iscsit_release_commands_from_conn()
      -> transport_generic_free_cmd() -> transport_wait_for_tasks() code.
      
      It moves iscsit_free_queue_reqs_for_conn() after the per-connection command
      list has been released, so that the associated se_cmd tag can be completed +
      released by target-core before freeing any remaining iscsi_queue_req memory
      for the connection generated by lio_queue_tm_rsp().
      
      Cc: Thomas Glanzmann <thomas@glanzmann.de>
      Cc: Charalampos Pournaris <charpour@gmail.com>
      Cc: stable@vger.kernel.org # 3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      bbc05048
  14. 07 6月, 2014 1 次提交
  15. 04 6月, 2014 1 次提交
    • N
      iser-target: Fix multi network portal shutdown regression · 2363d196
      Nicholas Bellinger 提交于
      This patch fixes a iser-target specific regression introduced in
      v3.15-rc6 with:
      
      commit 14f4b54f
      Author: Sagi Grimberg <sagig@mellanox.com>
      Date:   Tue Apr 29 13:13:47 2014 +0300
      
          Target/iscsi,iser: Avoid accepting transport connections during stop stage
      
      where the change to set iscsi_np->enabled = false within
      iscsit_clear_tpg_np_login_thread() meant that a iscsi_np with
      two iscsi_tpg_np exports would have it's parent iscsi_np set
      to a disabled state, even if other iscsi_tpg_np exports still
      existed.
      
      This patch changes iscsit_clear_tpg_np_login_thread() to only
      set iscsi_np->enabled = false when shutdown = true, and also
      changes iscsit_del_np() to set iscsi_np->enabled = true when
      iscsi_np->np_exports is non zero.
      
      Cc: Sagi Grimberg <sagig@dev.mellanox.co.il>
      Cc: stable@vger.kernel.org # 3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      2363d196
  16. 16 5月, 2014 1 次提交
    • N
      iscsi-target: Change BUG_ON to REJECT in iscsit_process_nop_out · 7cbfcc95
      Nicholas Bellinger 提交于
      This patch changes an incorrect use of BUG_ON to instead generate a
      REJECT + PROTOCOL_ERROR in iscsit_process_nop_out() code.  This case
      can occur with traditional TCP where a flood of zeros in the data
      stream can reach this block for what is presumed to be a NOP-OUT with
      a solicited reply, but without a valid iscsi_cmd pointer.
      
      This incorrect BUG_ON was introduced during the v3.11-rc timeframe
      with the following commit:
      
      commit 778de368
      Author: Nicholas Bellinger <nab@linux-iscsi.org>
      Date:   Fri Jun 14 16:07:47 2013 -0700
      
          iscsi/isert-target: Refactor ISCSI_OP_NOOP RX handling
      Reported-by: NArshad Hussain <arshad.hussain@calsoftinc.com>
      Cc: stable@vger.kernel.org # 3.11+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      7cbfcc95
  17. 07 4月, 2014 4 次提交
    • N
      target: Pass in transport supported PI at session initialization · e70beee7
      Nicholas Bellinger 提交于
      In order to support local WRITE_INSERT + READ_STRIP operations for
      non PI enabled fabrics, the fabric driver needs to be able signal
      what protection offload operations are supported.
      
      This is done at session initialization time so the modes can be
      signaled by individual se_wwn + se_portal_group endpoints, as well
      as optionally across different transports on the same endpoint.
      
      For iser-target, set TARGET_PROT_ALL if the underlying ib_device
      has already signaled PI offload support, and allow this to be
      exposed via a new iscsit_transport->iscsit_get_sup_prot_ops()
      callback.
      
      For loopback, set TARGET_PROT_ALL to signal SCSI initiator mode
      operation.
      
      For all other drivers, set TARGET_PROT_NORMAL to disable fabric
      level PI.
      
      Cc: Martin K. Petersen <martin.petersen@oracle.com>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Or Gerlitz <ogerlitz@mellanox.com>
      Cc: Quinn Tran <quinn.tran@qlogic.com>
      Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      e70beee7
    • N
      iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug · d444edc6
      Nicholas Bellinger 提交于
      This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()
      where during ERL=2 connection recovery, a bogus conn_p pointer could
      end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION
      notifying the initiator that cmd->logout_cid has failed.
      
      The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with
      a bogus conn_p pointer in iscsit_build_conn_drop_async_message().
      Reported-by: NArshad Hussain <arshad.hussain@calsoftinc.com>
      Reported-by: Nsantosh kulkarni <santosh.kulkarni@calsoftinc.com>
      Cc: <stable@vger.kernel.org> #3.1+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      d444edc6
    • N
      target: Add TFO->abort_task for aborted task resources release · 131e6abc
      Nicholas Bellinger 提交于
      Now that TASK_ABORTED status is not generated for all cases by
      TMR ABORT_TASK + LUN_RESET, a new TFO->abort_task() caller is
      necessary in order to give fabric drivers a chance to unmap
      hardware / software resources before the se_cmd descriptor is
      released via the normal TFO->release_cmd() codepath.
      
      This patch adds TFO->aborted_task() in core_tmr_abort_task()
      in place of the original transport_send_task_abort(), and
      also updates all fabric drivers to implement this caller.
      
      The fabric drivers that include changes to perform cleanup
      via ->aborted_task() are:
      
        - iscsi-target
        - iser-target
        - srpt
        - tcm_qla2xxx
      
      The fabric drivers that currently set ->aborted_task() to
      NOPs are:
      
        - loopback
        - tcm_fc
        - usb-gadget
        - sbp-target
        - vhost-scsi
      
      For the latter five, there appears to be no additional cleanup
      required before invoking TFO->release_cmd() to release the
      se_cmd descriptor.
      
      v2 changes:
        - Move ->aborted_task() call into transport_cmd_finish_abort (Alex)
      
      Cc: Alex Leung <amleung21@yahoo.com>
      Cc: Mark Rustad <mark.d.rustad@intel.com>
      Cc: Roland Dreier <roland@kernel.org>
      Cc: Vu Pham <vu@mellanox.com>
      Cc: Chris Boot <bootc@bootc.net>
      Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
      Cc: Saurav Kashyap <saurav.kashyap@qlogic.com>
      Cc: Quinn Tran <quinn.tran@qlogic.com>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Or Gerlitz <ogerlitz@mellanox.com>
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      131e6abc
    • A
      iscsi-target: Add missing NopOUT->flag (LMB) sanity check · a3662605
      Arshad Hussain 提交于
      This patch adds check for NopOUT->flag (LMB) which is a mandatory
      as per RFC 3720 Section 10.18.
      
      (Fix up context changes for v3.14-rc code - nab)
      Signed-off-by: NArshad Hussain <arshad.hussain@calsoftinc.com>
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      a3662605
  18. 05 3月, 2014 2 次提交
    • N
      iscsi/iser-target: Fix isert_conn->state hung shutdown issues · defd8848
      Nicholas Bellinger 提交于
      This patch addresses a couple of different hug shutdown issues
      related to wait_event() + isert_conn->state.  First, it changes
      isert_conn->conn_wait + isert_conn->conn_wait_comp_err from
      waitqueues to completions, and sets ISER_CONN_TERMINATING from
      within isert_disconnect_work().
      
      Second, it splits isert_free_conn() into isert_wait_conn() that
      is called earlier in iscsit_close_connection() to ensure that
      all outstanding commands have completed before continuing.
      
      Finally, it breaks isert_cq_comp_err() into seperate TX / RX
      related code, and adds logic in isert_cq_rx_comp_err() to wait
      for outstanding commands to complete before setting ISER_CONN_DOWN
      and calling complete(&isert_conn->conn_wait_comp_err).
      Acked-by: NSagi Grimberg <sagig@mellanox.com>
      Cc: Or Gerlitz <ogerlitz@mellanox.com>
      Cc: <stable@vger.kernel.org> #3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      defd8848
    • N
      iscsi/iser-target: Use list_del_init for ->i_conn_node · 5159d763
      Nicholas Bellinger 提交于
      There are a handful of uses of list_empty() for cmd->i_conn_node
      within iser-target code that expect to return false once a cmd
      has been removed from the per connect list.
      
      This patch changes all uses of list_del -> list_del_init in order
      to ensure that list_empty() returns false as expected.
      Acked-by: NSagi Grimberg <sagig@mellanox.com>
      Cc: Or Gerlitz <ogerlitz@mellanox.com>
      Cc: <stable@vger.kernel.org> #3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      5159d763
  19. 30 1月, 2014 1 次提交
    • A
      target/iscsi: Fix network portal creation race · ee291e63
      Andy Grover 提交于
      When creating network portals rapidly, such as when restoring a
      configuration, LIO's code to reuse existing portals can return a false
      negative if the thread hasn't run yet and set np_thread_state to
      ISCSI_NP_THREAD_ACTIVE. This causes an error in the network stack
      when attempting to bind to the same address/port.
      
      This patch sets NP_THREAD_ACTIVE before the np is placed on g_np_list,
      so even if the thread hasn't run yet, iscsit_get_np will return the
      existing np.
      
      Also, convert np_lock -> np_mutex + hold across adding new net portal
      to g_np_list to prevent a race where two threads may attempt to create
      the same network portal, resulting in one of them failing.
      
      (nab: Add missing mutex_unlocks in iscsit_add_np failure paths)
      (DanC: Fix incorrect spin_unlock -> spin_unlock_bh)
      Signed-off-by: NAndy Grover <agrover@redhat.com>
      Cc: <stable@vger.kernel.org> #3.1+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      ee291e63
  20. 25 1月, 2014 1 次提交
  21. 19 12月, 2013 1 次提交
    • N
      iscsi-target: Fix incorrect np->np_thread NULL assignment · db6077fd
      Nicholas Bellinger 提交于
      When shutting down a target there is a race condition between
      iscsit_del_np() and __iscsi_target_login_thread().
      The latter sets the thread pointer to NULL, and the former
      tries to issue kthread_stop() on that pointer without any
      synchronization.
      
      This patch moves the np->np_thread NULL assignment into
      iscsit_del_np(), after kthread_stop() has completed. It also
      removes the signal_pending() + np_state check, and only
      exits when kthread_should_stop() is true.
      Reported-by: NHannes Reinecke <hare@suse.de>
      Cc: <stable@vger.kernel.org> #3.12+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      db6077fd
  22. 12 12月, 2013 1 次提交
    • N
      iscsi-target: Fix-up all zero data-length CDBs with R/W_BIT set · 4454b66c
      Nicholas Bellinger 提交于
      This patch changes special case handling for ISCSI_OP_SCSI_CMD
      where an initiator sends a zero length Expected Data Transfer
      Length (EDTL), but still sets the WRITE and/or READ flag bits
      when no payload transfer is requested.
      
      Many, many moons ago two special cases where added for an ancient
      version of ESX that has long since been fixed, so instead of adding
      a new special case for the reported bug with a Broadcom 57800 NIC,
      go ahead and always strip off the incorrect WRITE + READ flag bits.
      
      Also, avoid sending a reject here, as RFC-3720 does mandate this
      case be handled without protocol error.
      Reported-by: NWitold Bazakbal <865perl@wp.pl>
      Tested-by: NWitold Bazakbal <865perl@wp.pl>
      Cc: <stable@vger.kernel.org> #3.1+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      4454b66c
  23. 20 11月, 2013 1 次提交
    • N
      iscsi-target: Convert iscsi_session statistics to atomic_long_t · 04f3b31b
      Nicholas Bellinger 提交于
      This patch converts a handful of iscsi_session statistics to type
      atomic_long_t, instead of using iscsi_session->session_stats_lock
      when incrementing these values.
      
      More importantly, go ahead and drop the spinlock usage within
      iscsit_setup_scsi_cmd(), iscsit_check_dataout_hdr(),
      iscsit_send_datain(), and iscsit_build_rsp_pdu() fast-path code.
      
      (Squash in Roland's  target: Remove write-only stats fields and lock
      from struct se_node_acl)
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      04f3b31b
  24. 14 11月, 2013 1 次提交
  25. 08 11月, 2013 1 次提交
  26. 24 10月, 2013 1 次提交
  27. 17 10月, 2013 1 次提交
  28. 04 10月, 2013 1 次提交
    • N
      iscsi-target: Perform release of acknowledged tags from RX context · f56cbbb4
      Nicholas Bellinger 提交于
      This patch converts iscsit_ack_from_expstatsn() to populate a local
      ack_list of commands, and call iscsit_free_cmd() directly from RX
      thread context, instead of using iscsit_add_cmd_to_immediate_queue()
      to queue the acknowledged commands to be released from TX thread
      context.
      
      It is helpful to release the acknowledge commands as quickly as
      possible, along with the associated percpu_ida tags, in order to
      prevent percpu_ida_alloc() from having to steal tags from other
      CPUs while waiting for iscsit_free_cmd() to happen from TX thread
      context.
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      f56cbbb4
  29. 11 9月, 2013 1 次提交
  30. 10 9月, 2013 2 次提交
    • N
      iscsi/iser-target: Convert to command priv_size usage · d703ce2f
      Nicholas Bellinger 提交于
      This command converts iscsi/isert-target to use allocations based on
      iscsit_transport->priv_size within iscsit_allocate_cmd(), instead of
      using an embedded isert_cmd->iscsi_cmd.
      
      This includes removing iscsit_transport->alloc_cmd() usage, along
      with updating isert-target code to use iscsit_priv_cmd().
      
      Also, remove left-over iscsit_transport->release_cmd() usage for
      direct calls to iscsit_release_cmd(), and drop the now unused
      lio_cmd_cache and isert_cmd_cache.
      
      Cc: Or Gerlitz <ogerlitz@mellanox.com>
      Cc: Kent Overstreet <kmo@daterainc.com>
      Signed-off-by: NNicholas Bellinger <nab@daterainc.com>
      d703ce2f
    • N
      iscsi-target: Prepare login code for multi-plexing support · a91eb7d9
      Nicholas Bellinger 提交于
      This patch prepares the iscsi-target login code for multi-plexing
      support.  This includes:
      
       - Adding iscsi_tpg_np->tpg_np_kref + iscsit_login_kref_put() for
         handling callback of iscsi_tpg_np->tpg_np_comp
       - Adding kref_put() in iscsit_deaccess_np()
       - Adding kref_put() and wait_for_completion() in
         iscsit_reset_np_thread()
       - Refactor login failure path release logic into
         iscsi_target_login_sess_out()
       - Update __iscsi_target_login_thread() to handle
         iscsi_post_login_handler() asynchronous completion
       - Add shutdown parameter for iscsit_clear_tpg_np_login_thread*()
      
      v3 changes:
       - Convert iscsi_portal_group->np_login_lock to ->np_login_sem
       - Add LOGIN_FLAGS definitions
      
      v2 changes:
       - Remove duplicate call to iscsi_post_login_handler() in
         __iscsi_target_login_thread()
       - Drop unused iscsi_np->np_login_tpg
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      a91eb7d9
  31. 24 8月, 2013 1 次提交
    • N
      iscsi-target: Fix potential NULL pointer in solicited NOPOUT reject · 28aaa950
      Nicholas Bellinger 提交于
      This patch addresses a potential NULL pointer dereference regression in
      iscsit_setup_nop_out() code, specifically for two cases when a solicited
      NOPOUT triggers a ISCSI_REASON_PROTOCOL_ERROR reject to be generated.
      
      This is because iscsi_cmd is expected to be NULL for solicited NOPOUT
      case before iscsit_process_nop_out() locates the descriptor via TTT
      using iscsit_find_cmd_from_ttt().
      
      This regression was originally introduced in:
      
      commit ba159914
      Author: Nicholas Bellinger <nab@linux-iscsi.org>
      Date:   Wed Jul 3 03:48:24 2013 -0700
      
          iscsi-target: Fix iscsit_add_reject* usage for iser
      
      Cc: stable@vger.kernel.org  # 3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      28aaa950
  32. 22 8月, 2013 1 次提交
    • N
      iscsi-target: Fix ImmediateData=Yes failure regression in >= v3.10 · 9d86a2be
      Nicholas Bellinger 提交于
      This patch addresses a regression bug within ImmediateData=Yes failure
      handling that ends up triggering an OOPs within >= v3.10 iscsi-target
      code.
      
      The problem occurs when iscsit_process_scsi_cmd() does the call to
      target_put_sess_cmd(), and once again in iscsit_get_immediate_data()
      that is triggered during two different cases:
      
       - When iscsit_sequence_cmd() returns CMDSN_LOWER_THAN_EXP, for which
         the descriptor state will already have been set to ISTATE_REMOVE
         by iscsit_sequence_cmd(), and
       - When iscsi_cmd->sense_reason is set, for which iscsit_execute_cmd()
         will have already called transport_send_check_condition_and_sense()
         to queue the exception response.
      
      It changes iscsit_process_scsi_cmd() to drop the early call, and makes
      iscsit_get_immediate_data() call target_put_sess_cmd() from a single
      location after dumping the immediate data for the failed command.
      
      The regression was initially introduced in commit:
      
      commit 561bf158
      Author: Nicholas Bellinger <nab@linux-iscsi.org>
      Date:   Wed Jul 3 03:58:58 2013 -0700
      
          iscsi-target: Fix iscsit_sequence_cmd reject handling for iser
      
      Cc: stable@vger.kernel.org # 3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      9d86a2be
  33. 13 8月, 2013 1 次提交
    • C
      iscsi-target: ST response on IN6ADDR_ANY socket · dfecf611
      Chris Leech 提交于
      Odd little issue, found that if you create an IPv6 portal bound to the
      IN6ADDR_ANY wildcard address it will accept IPv4 connections (as long as
      bindv6only isn't set globally) but respond to SendTargets requests with
      an IPv4-mapped IPv6 address.
      
      Example over loopback:
      
       In targetcli create a wildcard IPv6 portal
         /iscsi/iqn.../portals/> create ::
       Which should create a portal [::]:3260
      
       Initiate SendTargets discovery to the portal using an IPv4 address
         # iscsiadm -m discovery -t st -p 127.0.0.1
       The response formats TargetAddress as [::ffff:127.0.0.1]:3260,1
      
      This still works and uses v4 on the network between two v6 sockets, but
      only if the initiator supports IPv6 with v4-mapped addresses.
      
      This change detects v4-mapped address on v6 sockets for the wildcard
      case, and instead formats the TargetAddress response as an IPv4 address.
      
      In order to not further complicate iscsit_build_sendtargets_response,
      I've actually simplified it by moving the bracket wrapping of IPv6
      address into iscsit_accept_np where local_ip and login_ip strings are
      set.  That also simplifies iscsi_stat_tgt_attr_show_attr_fail_intr_addr.
      
      Side effect of the string format change is that
      lio_target_nacl_show_info will now print login_ip bracket wrapped for
      IPv6 connections, as will a few debug prints.
      Signed-off-by: NChris Leech <cleech@redhat.com>
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      dfecf611