1. 20 7月, 2016 1 次提交
    • N
      target: Fix race between iscsi-target connection shutdown + ABORT_TASK · 064cdd2d
      Nicholas Bellinger 提交于
      This patch fixes a race in iscsit_release_commands_from_conn() ->
      iscsit_free_cmd() -> transport_generic_free_cmd() + wait_for_tasks=1,
      where CMD_T_FABRIC_STOP could end up being set after the final
      kref_put() is called from core_tmr_abort_task() context.
      
      This results in transport_generic_free_cmd() blocking indefinately
      on se_cmd->cmd_wait_comp, because the target_release_cmd_kref()
      check for CMD_T_FABRIC_STOP returns false.
      
      To address this bug, make iscsit_release_commands_from_conn()
      do list_splice and set CMD_T_FABRIC_STOP early while holding
      iscsi_conn->cmd_lock.  Also make iscsit_aborted_task() only
      remove iscsi_cmd_t if CMD_T_FABRIC_STOP has not already been
      set.
      
      Finally in target_release_cmd_kref(), only honor fabric_stop
      if CMD_T_ABORTED has been set.
      
      Cc: Mike Christie <mchristi@redhat.com>
      Cc: Quinn Tran <quinn.tran@qlogic.com>
      Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Hannes Reinecke <hare@suse.de>
      Cc: stable@vger.kernel.org # 3.14+
      Tested-by: NNicholas Bellinger <nab@linux-iscsi.org>
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      064cdd2d
  2. 17 5月, 2016 1 次提交
    • N
      iscsi-target: Convert transport drivers to signal rdma_shutdown · bd027d85
      Nicholas Bellinger 提交于
      Instead of special casing the handful of callers that check for
      iser-target rdma verbs specific shutdown, use a simple flag at
      iscsit_transport->rdma_shutdown so each driver can signal this.
      
      Also, update iscsi-target/tcp + cxgbit to rdma_shutdown = false.
      
      Cc: Varun Prakash <varun@chelsio.com>
      Cc: Hariprasad Shenai <hariprasad@chelsio.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Sagi Grimberg <sagi@grimberg.me>
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      bd027d85
  3. 10 5月, 2016 11 次提交
  4. 27 1月, 2016 1 次提交
  5. 20 1月, 2016 1 次提交
    • N
      target: Obtain se_node_acl->acl_kref during get_initiator_node_acl · 21aaa23b
      Nicholas Bellinger 提交于
      This patch addresses a long standing race where obtaining
      se_node_acl->acl_kref in __transport_register_session()
      happens a bit too late, and leaves open the potential
      for core_tpg_del_initiator_node_acl() to hit a NULL
      pointer dereference.
      
      Instead, take ->acl_kref in core_tpg_get_initiator_node_acl()
      while se_portal_group->acl_node_mutex is held, and move the
      final target_put_nacl() from transport_deregister_session()
      into transport_free_session() so that fabric driver login
      failure handling using the modern method to still work
      as expected.
      
      Also, update core_tpg_get_initiator_node_acl() to take
      an extra reference for dynamically generated acls for
      demo-mode, before returning to fabric caller.  Also
      update iscsi-target sendtargets special case handling
      to use target_tpg_has_node_acl() when checking if
      demo_mode_discovery == true during discovery lookup.
      
      Note the existing wait_for_completion(&acl->acl_free_comp)
      in core_tpg_del_initiator_node_acl() does not change.
      
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Hannes Reinecke <hare@suse.de>
      Cc: Andy Grover <agrover@redhat.com>
      Cc: Mike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      21aaa23b
  6. 07 1月, 2016 1 次提交
  7. 29 11月, 2015 1 次提交
    • N
      iscsi-target: Fix rx_login_comp hang after login failure · ca82c2bd
      Nicholas Bellinger 提交于
      This patch addresses a case where iscsi_target_do_tx_login_io()
      fails sending the last login response PDU, after the RX/TX
      threads have already been started.
      
      The case centers around iscsi_target_rx_thread() not invoking
      allow_signal(SIGINT) before the send_sig(SIGINT, ...) occurs
      from the failure path, resulting in RX thread hanging
      indefinately on iscsi_conn->rx_login_comp.
      
      Note this bug is a regression introduced by:
      
        commit e5419865
        Author: Nicholas Bellinger <nab@linux-iscsi.org>
        Date:   Wed Jul 22 23:14:19 2015 -0700
      
            iscsi-target: Fix iscsit_start_kthreads failure OOPs
      
      To address this bug, complete ->rx_login_complete for good
      measure in the failure path, and immediately return from
      RX thread context if connection state did not actually reach
      full feature phase (TARG_CONN_STATE_LOGGED_IN).
      
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: <stable@vger.kernel.org> # v3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      ca82c2bd
  8. 27 8月, 2015 3 次提交
  9. 03 8月, 2015 2 次提交
  10. 31 7月, 2015 2 次提交
  11. 25 7月, 2015 3 次提交
    • N
      iscsi-target: Fix iser explicit logout TX kthread leak · 007d038b
      Nicholas Bellinger 提交于
      This patch fixes a regression introduced with the following commit
      in v4.0-rc1 code, where an explicit iser-target logout would result
      in ->tx_thread_active being incorrectly cleared by the logout post
      handler, and subsequent TX kthread leak:
      
          commit 88dcd2da
          Author: Nicholas Bellinger <nab@linux-iscsi.org>
          Date:   Thu Feb 26 22:19:15 2015 -0800
      
              iscsi-target: Convert iscsi_thread_set usage to kthread.h
      
      To address this bug, change iscsit_logout_post_handler_closesession()
      and iscsit_logout_post_handler_samecid() to only cmpxchg() on
      ->tx_thread_active for traditional iscsi/tcp connections.
      
      This is required because iscsi/tcp connections are invoking logout
      post handler logic directly from TX kthread context, while iser
      connections are invoking logout post handler logic from a seperate
      workqueue context.
      
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: <stable@vger.kernel.org> # v3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      007d038b
    • N
      iscsi-target: Fix iscsit_start_kthreads failure OOPs · e5419865
      Nicholas Bellinger 提交于
      This patch fixes a regression introduced with the following commit
      in v4.0-rc1 code, where a iscsit_start_kthreads() failure triggers
      a NULL pointer dereference OOPs:
      
          commit 88dcd2da
          Author: Nicholas Bellinger <nab@linux-iscsi.org>
          Date:   Thu Feb 26 22:19:15 2015 -0800
      
              iscsi-target: Convert iscsi_thread_set usage to kthread.h
      
      To address this bug, move iscsit_start_kthreads() immediately
      preceeding the transmit of last login response, before signaling
      a successful transition into full-feature-phase within existing
      iscsi_target_do_tx_login_io() logic.
      
      This ensures that no target-side resource allocation failures can
      occur after the final login response has been successfully sent.
      
      Also, it adds a iscsi_conn->rx_login_comp to allow the RX thread
      to sleep to prevent other socket related failures until the final
      iscsi_post_login_handler() call is able to complete.
      
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: <stable@vger.kernel.org> # v3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      e5419865
    • N
      iscsi-target: Fix use-after-free during TPG session shutdown · 417c20a9
      Nicholas Bellinger 提交于
      This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
      where se_portal_group->session_lock was incorrectly released/re-acquired
      while walking the active se_portal_group->tpg_sess_list.
      
      The can result in a NULL pointer dereference when iscsit_close_session()
      shutdown happens in the normal path asynchronously to this code, causing
      a bogus dereference of an already freed list entry to occur.
      
      To address this bug, walk the session list checking for the same state
      as before, but move entries to a local list to avoid dropping the lock
      while walking the active list.
      
      As before, signal using iscsi_session->session_restatement=1 for those
      list entries to be released locally by iscsit_free_session() code.
      Reported-by: NSunilkumar Nadumuttlu <sjn@datera.io>
      Cc: Sunilkumar Nadumuttlu <sjn@datera.io>
      Cc: <stable@vger.kernel.org> # v3.1+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      417c20a9
  12. 02 6月, 2015 1 次提交
    • B
      target: Minimize SCSI header #include directives · ba929992
      Bart Van Assche 提交于
      Only include SCSI initiator header files in target code that needs
      these header files, namely the SCSI pass-through code and the tcm_loop
      driver. Change SCSI_SENSE_BUFFERSIZE into TRANSPORT_SENSE_BUFFER in
      target code because the former is intended for initiator code and the
      latter for target code. With this patch the only initiator include
      directives in target code that remain are as follows:
      
      $ git grep -nHE 'include .scsi/(scsi.h|scsi_host.h|scsi_device.h|scsi_cmnd.h)' drivers/target drivers/infiniband/ulp/{isert,srpt} drivers/usb/gadget/legacy/tcm_*.[ch] drivers/{vhost,xen} include/{target,trace/events/target.h}
      drivers/target/loopback/tcm_loop.c:29:#include <scsi/scsi.h>
      drivers/target/loopback/tcm_loop.c:31:#include <scsi/scsi_host.h>
      drivers/target/loopback/tcm_loop.c:32:#include <scsi/scsi_device.h>
      drivers/target/loopback/tcm_loop.c:33:#include <scsi/scsi_cmnd.h>
      drivers/target/target_core_pscsi.c:39:#include <scsi/scsi_device.h>
      drivers/target/target_core_pscsi.c:40:#include <scsi/scsi_host.h>
      drivers/xen/xen-scsiback.c:52:#include <scsi/scsi_host.h> /* SG_ALL */
      Signed-off-by: NBart Van Assche <bart.vanassche@sandisk.com>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NJames Bottomley <JBottomley@Odin.com>
      ba929992
  13. 31 5月, 2015 4 次提交
  14. 29 5月, 2015 1 次提交
  15. 20 5月, 2015 1 次提交
  16. 15 4月, 2015 1 次提交
    • C
      target: simplify the target template registration API · 9ac8928e
      Christoph Hellwig 提交于
      Instead of calling target_fabric_configfs_init() +
      target_fabric_configfs_register() / target_fabric_configfs_deregister()
      target_fabric_configfs_free() from every target driver, rewrite the API
      so that we have simple register/unregister functions that operate on
      a const operations vector.
      
      This patch also fixes a memory leak in several target drivers. Several
      target drivers namely called target_fabric_configfs_deregister()
      without calling target_fabric_configfs_free().
      
      A large part of this patch is based on earlier changes from
      Bart Van Assche <bart.vanassche@sandisk.com>.
      
      (v2: Add a new TF_CIT_SETUP_DRV macro so that the core configfs code
      can declare attributes as either core only or for drivers)
      Signed-off-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      9ac8928e
  17. 11 4月, 2015 1 次提交
    • M
      iscsi target: fix oops when adding reject pdu · b815fc12
      Mike Christie 提交于
      This fixes a oops due to a double list add when adding a reject PDU for
      iscsit_allocate_iovecs allocation failures. The cmd has already been
      added to the conn_cmd_list in iscsit_setup_scsi_cmd, so this has us call
      iscsit_reject_cmd.
      
      Note that for ERL0 the reject PDU is not actually sent, so this patch
      is not completely tested. Just verified we do not oops. The problem is the
      add reject functions return -1 which is returned all the way up to
      iscsi_target_rx_thread which for ERL0 will drop the connection.
      Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
      Cc: <stable@vger.kernel.org> # v3.10+
      Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>
      b815fc12
  18. 08 4月, 2015 1 次提交
  19. 27 3月, 2015 2 次提交
  20. 21 3月, 2015 1 次提交