summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2014-06-11TARGET/sbc,loopback: Adjust command data length in case pi exists on the wireSagi Grimberg
In various areas of the code, it is assumed that se_cmd->data_length describes pure data. In case that protection information exists over the wire (protect bits is are on) the target core re-calculates the data length from the CDB and the backed device block size (instead of each transport peeking in the cdb). Modify loopback device to include protection information in the transferred data length (like other scsi transports). Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.15+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-11libiscsi, iser: Adjust data_length to include protection informationSagi Grimberg
In case protection information exists over the wire iscsi header data length is required to include it. Use protection information aware scsi helpers to set the correct transfer length. In order to avoid breakage, remove iser transfer length checks for each task as they are not always true and somewhat redundant anyway. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Acked-by: Mike Christie <michaelc@cs.wisc.edu> Cc: stable@vger.kernel.org # 3.15+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-11target: Report correct response length for some commandsRoland Dreier
When an initiator sends an allocation length bigger than what its command consumes, the target should only return the actual response data and set the residual length to the unused part of the allocation length. Add a helper function that command handlers (INQUIRY, READ CAPACITY, etc) can use to do this correctly, and use this code to get the correct residual for commands that don't use the full initiator allocation in the handlers for READ CAPACITY, READ CAPACITY(16), INQUIRY, MODE SENSE and REPORT LUNS. This addresses a handful of failures as reported by Christophe with the Windows Certification Kit: http://permalink.gmane.org/gmane.linux.scsi.target.devel/6515 Signed-off-by: Roland Dreier <roland@purestorage.com> Tested-by: Christophe Vu-Brugier <cvubrugier@yahoo.fr> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-11target/sbc: Check that the LBA and number of blocks are correct in VERIFYChristophe Vu-Brugier
This patch extracts LBA + sectors for VERIFY, and adds a goto check_lba to perform the end-of-device checking. (Update patch to drop lba_check usage - nab) Signed-off-by: Christophe Vu-Brugier <cvubrugier@yahoo.fr> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-11target/sbc: Remove sbc_check_valid_sectors()Christophe Vu-Brugier
A similar check is performed at the end of sbc_parse_cdb() and is now enforced if the SYNCHRONIZE CACHE command's backend supports ->execute_sync_cache(). (Add check_lba goto to avoid *_max_sectors checks - nab) Signed-off-by: Christophe Vu-Brugier <cvubrugier@yahoo.fr> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-11Target/iscsi: Fix sendtargets response pdu for iser transportSagi Grimberg
In case the transport is iser we should not include the iscsi target info in the sendtargets text response pdu. This causes sendtargets response to include the target info twice. Modify iscsit_build_sendtargets_response to filter transport types that don't match. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Reported-by: Slava Shwartsman <valyushash@gmail.com> Cc: stable@vger.kernel.org # 3.11+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-11Target/iser: Fix a wrong dereference in case discovery session is over iserSagi Grimberg
In case the discovery session is carried over iser, we can't access the assumed network portal since the default portal is used. In this case we don't really need to allocate the fastreg pool, just prepare to the text pdu that will follow. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Reported-by: Alex Tabachnik <alext@mellanox.com> Cc: stable@vger.kernel.org # 3.15+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-10iscsi-target: Fix ABORT_TASK + connection reset iscsi_queue_req memory leakNicholas Bellinger
This patch fixes a iscsi_queue_req memory leak when ABORT_TASK response has been queued by TFO->queue_tm_rsp() -> lio_queue_tm_rsp() after a long standing I/O completes, but the connection has already reset and waiting for cleanup to complete in iscsit_release_commands_from_conn() -> transport_generic_free_cmd() -> transport_wait_for_tasks() code. It moves iscsit_free_queue_reqs_for_conn() after the per-connection command list has been released, so that the associated se_cmd tag can be completed + released by target-core before freeing any remaining iscsi_queue_req memory for the connection generated by lio_queue_tm_rsp(). Cc: Thomas Glanzmann <thomas@glanzmann.de> Cc: Charalampos Pournaris <charpour@gmail.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-10target: Use complete_all for se_cmd->t_transport_stop_compNicholas Bellinger
This patch fixes a bug where multiple waiters on ->t_transport_stop_comp occurs due to a concurrent ABORT_TASK and session reset both invoking transport_wait_for_tasks(), while waiting for the associated se_cmd descriptor backend processing to complete. For this case, complete_all() should be invoked in order to wake up both waiters in core_tmr_abort_task() + transport_generic_free_cmd() process contexts. Cc: Thomas Glanzmann <thomas@glanzmann.de> Cc: Charalampos Pournaris <charpour@gmail.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-10target: Set CMD_T_ACTIVE bit for Task Management RequestsNicholas Bellinger
This patch fixes a bug where se_cmd descriptors associated with a Task Management Request (TMR) where not setting CMD_T_ACTIVE before being dispatched into target_tmr_work() process context. This is required in order for transport_generic_free_cmd() -> transport_wait_for_tasks() to wait on se_cmd->t_transport_stop_comp if a session reset event occurs while an ABORT_TASK is outstanding waiting for another I/O to complete. Cc: Thomas Glanzmann <thomas@glanzmann.de> Cc: Charalampos Pournaris <charpour@gmail.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-06target: cleanup some boolean testsChristophe Vu-Brugier
Convert "x == true" to "x" and "x == false" to "!x". Signed-off-by: Christophe Vu-Brugier <cvubrugier@yahoo.fr> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-06target/spc: Simplify INQUIRY EVPD=0x80Christophe Vu-Brugier
Signed-off-by: Christophe Vu-Brugier <cvubrugier@yahoo.fr> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-06tcm_fc: Generate TASK_SET_FULL status for response failuresNicholas Bellinger
This patch changes ft_queue_status() to set SAM_STAT_TASK_SET_FULL status upon lport->tt.seq_send( failure, and return -EAGAIN to notify target-core to attempt to requeue the response. It also does the same for a fc_frame_alloc() failures, in order to signal the initiator that it should try to reduce it's current queue_depth, to lower the number of outstanding I/Os on the wire. Reported-by: Vasu Dev <vasu.dev@linux.intel.com> Reviewed-by: Vasu Dev <vasu.dev@linux.intel.com> Cc: Jun Wu <jwu@stormojo.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-06tcm_fc: Generate TASK_SET_FULL status for DataIN failuresNicholas Bellinger
This patch changes ft_queue_data_in() to set SAM_STAT_TASK_SET_FULL status upon a lport->tt.seq_send() failure, where it will now stop sending subsequent DataIN, and immediately attempt to send the response with exception status. Sending a response with SAM_STAT_TASK_SET_FULL status is useful in order to signal the initiator that it should try to reduce it's current queue_depth, to lower the number of outstanding I/Os on the wire. Also, add a check to skip sending DataIN if TASK_SET_FULL status has already been set due to a response lport->tt.seq_send() failure, that has asked target-core to requeue a response. Reported-by: Vasu Dev <vasu.dev@linux.intel.com> Reviewed-by: Vasu Dev <vasu.dev@linux.intel.com> Cc: Jun Wu <jwu@stormojo.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-06iscsi-target: Reject mutual authentication with reflected CHAP_CNicholas Bellinger
This patch adds an explicit check in chap_server_compute_md5() to ensure the CHAP_C value received from the initiator during mutual authentication does not match the original CHAP_C provided by the target. This is in line with RFC-3720, section 8.2.1: Originators MUST NOT reuse the CHAP challenge sent by the Responder for the other direction of a bidirectional authentication. Responders MUST check for this condition and close the iSCSI TCP connection if it occurs. Reported-by: Tejas Vaykole <tejas.vaykole@calsoftinc.com> Cc: stable@vger.kernel.org # 3.1+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-06iscsi-target: Remove no-op from iscsit_tpg_del_portal_groupNicholas Bellinger
This patch removes a no-op iscsit_clear_tpg_np_login_threads() call in iscsit_tpg_del_portal_group(), which is unnecessary because iscsit_tpg_del_portal_group() can only ever be removed from configfs once all of the child network portals have been released. Also, go ahed and make iscsit_clear_tpg_np_login_threads() declared as static. Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-06iscsi-target: Fix CHAP_A parameter list handlingTejas Vaykole
The target is failing to handle list of CHAP_A key-value pair form initiator.The target is expecting CHAP_A=5 always. In other cases, where initiator sends list (for example) CHAP_A=6,5 target is failing the security negotiation. Which is incorrect. This patch handles the case (RFC 3720 section 11.1.4). where in the initiator may send list of CHAP_A values and target replies with appropriate CHAP_A value in response (Drop whitespaces + rename to chap_check_algorithm + save original pointer + add explicit check for CHAP_A key - nab) Signed-off-by: Tejas Vaykole <tejas.vaykole@calsoftinc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-04iscsi-target: Put length of failed allocation in error messageRoland Dreier
If the message "Unable to allocate…" pops up, it's useful to know whether the problem is that the system is genuinely out of memory, or that some bug has led to a crazy allocation length. In particular this helped debug a corruption of login headers in iscsi_login_non_zero_tsih_s1(). Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-04iscsi-target: Reject zero-length payloads during SecurityNegotiationNicholas Bellinger
This patch changes iscsi_target_handle_csg_zero() to explicitly reject login requests in SecurityNegotiation with a zero-length payload, following the language in RFC-3720 Section 8.2: Whenever an iSCSI target gets a response whose keys, or their values, are not according to the step definition, it MUST answer with a Login reject with the "Initiator Error" or "Missing Parameter" status. Previously when a zero-length login request in CSG=0 was received, the target would send a login response with CSG=0 + T_BIT=0 asking the initiator to complete authentication, and not fail the login until MAX_LOGIN_PDUS was reached. This change will now immediately fail the login attempt with ISCSI_STATUS_CLS_INITIATOR_ERR status. Reported-by: Tejas Vaykole <tejas.vaykole@calsoftinc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-04qla2xxx: Convert to percpu_ida session tag pre-allocationNicholas Bellinger
This patch converts qla2xxx target code to use generic percpu_ida tag allocation provided by target-core, thus removing the original kmem_cache_zalloc() for each struct qla_tgt_cmd descriptor in the incoming ATIO packet fast-path. This includes the conversion of qlt_handle_cmd_for_atio() to perform qla_tgt_sess lookup before dispatching a command descriptor into qla_tgt_wq process context, along with handling the case where no active session exists, and subsequently kicking off a seperate process context for qlt_create_sess_from_atio() to create a new one. It also includes moving tag allocation into generic code within qlt_get_tag(), so that the same logic can be shared between qlt_handle_cmd_for_atio() + qlt_create_sess_from_atio() contexts. Also, __qlt_do_work() has been made generic between both normal process context in qlt_do_work() + qlt_create_sess_from_atio(). Next, update qlt_free_cmd() to release the percpu-ida tags, and drop the now-unused global qla_tgt_cmd_cachep. Finally in tcm_qla2xxx code, tcm_qla2xxx_check_initiator_node_acl() has been updated to use transport_init_session_tags() along with a hardcoded TCM_QLA2XXX_DEFAULT_TAGS=2088 as the number of qla_tgt_cmd descriptors to pre-allocate per qla_tgt_sess instance. (Use ha->fw_xcb_count if available to calculate num_tags, and also factor in extra pad tags - Quinn) Cc: Saurav Kashyap <saurav.kashyap@qlogic.com> Cc: Quinn Tran <quinn.tran@qlogic.com> Cc: Giridhar Malavali <giridhar.malavali@qlogic.com> Cc: Chad Dupuis <chad.dupuis@qlogic.com> Cc: Roland Dreier <roland@kernel.org> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-02virtio-scsi: Enable DIF/DIX modes in SCSI host LLDNicholas Bellinger
This patch updates virtscsi_probe() to setup necessary Scsi_Host level protection resources. (currently hardcoded to 1) It changes virtscsi_add_cmd() to attach outgoing / incoming protection SGLs preceeding the data payload, and is using the new virtio_scsi_cmd_req_pi->pi_bytes[out,in] field to signal to signal to vhost/scsi bytes to expect for protection data. (Add missing #include <linux/blkdev.h> for blk_integrity - sfr + nab) Acked-by: Paolo Bonzini <pbonzini@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Cc: Sagi Grimberg <sagig@dev.mellanox.co.il> Cc: H. Peter Anvin <hpa@zytor.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-02vhost/scsi: Enable T10 PI IOV -> SGL memory mappingNicholas Bellinger
This patch updates vhost_scsi_handle_vq() to check for the existance of virtio_scsi_cmd_req_pi comparing vq->iov[0].iov_len in order to calculate seperate data + protection SGLs from data_num. Also update tcm_vhost_submission_work() to pass the pre-allocated cmd->tvc_prot_sgl[] memory into target_submit_cmd_map_sgls(), and update vhost_scsi_get_tag() parameters to accept scsi_tag, lun, and task_attr. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Cc: Sagi Grimberg <sagig@dev.mellanox.co.il> Cc: H. Peter Anvin <hpa@zytor.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-02vhost/scsi: Add T10 PI IOV -> SGL memory mapping logicNicholas Bellinger
This patch adds vhost_scsi_map_iov_to_prot() to perform the mapping of T10 data integrity memory between virtio iov + struct scatterlist using get_user_pages_fast() following existing code. As with vhost_scsi_map_iov_to_sgl(), this does sanity checks against the total prot_sgl_count vs. pre-allocated SGLs, and loops across protection iovs using vhost_scsi_map_to_sgl() to perform the actual memory mapping. Also update tcm_vhost_release_cmd() to release associated tvc_prot_sgl[] struct page. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Cc: Sagi Grimberg <sagig@dev.mellanox.co.il> Cc: H. Peter Anvin <hpa@zytor.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-02vhost/scsi: Add preallocation of protection SGLsNicholas Bellinger
This patch updates tcm_vhost_make_nexus() to pre-allocate per descriptor tcm_vhost_cmd->tvc_prot_sgl[] used to expose protection SGLs from within virtio-scsi guest memory to vhost-scsi. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-06-02vhost/scsi: Move sanity check into vhost_scsi_map_iov_to_sglNicholas Bellinger
Move the overflow check for sgl_count > TCM_VHOST_PREALLOC_SGLS into vhost_scsi_map_iov_to_sgl() so that it's based on the total number of SGLs for all IOVs, instead of single IOVs. Also, rename TCM_VHOST_PREALLOC_PAGES -> TCM_VHOST_PREALLOC_UPAGES to better describe pointers to user-space pages. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-20Target/iser: Gracefully reject T10-PI enabled connect request if not supportedSagi Grimberg
In case user chose to set T10-PI enable on the target while the IB device does not support it, gracefully reject the request. Reported-by: Slava Shwartsman <valyushash@gmail.com> Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.15+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-20Target/iser: Wait for proper cleanup before unloadingSagi Grimberg
disconnected_handler works are scheduled on system_wq. When attempting to unload, first make sure all works have cleaned up. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-20Target/iser: Improve cm events handlingSagi Grimberg
There are 4 RDMA_CM events that all basically mean that the user should teardown the IB connection: - DISCONNECTED - ADDR_CHANGE - DEVICE_REMOVAL - TIMEWAIT_EXIT Only in DISCONNECTED/ADDR_CHANGE it makes sense to call rdma_disconnect (send DREQ/DREP to our initiator). So we keep the same teardown handler for all of them but only indicate calling rdma_disconnect for the relevant events. This patch also removes redundant debug prints for each single event. v2 changes: - Call isert_disconnected_handler() for DEVICE_REMOVAL (Or + Sag) Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-19Target/iser: Fix hangs in connection teardownSagi Grimberg
In ungraceful teardowns isert close flows seem racy such that isert_wait_conn hangs as RDMA_CM_EVENT_DISCONNECTED never gets invoked (no one called rdma_disconnect). Both graceful and ungraceful teardowns will have rx flush errors (isert posts a batch once connection is established). Once all flush errors are consumed we invoke isert_wait_conn and it will be responsible for calling rdma_disconnect. This way it can be sure that rdma_disconnect was called and it won't wait forever. This patch also removes the logout_posted indicator. either the logout completion was consumed and no problem decrementing the post_send_buf_count, or it was consumed as a flush error. no point of keeping it for isert_wait_conn as there is no danger that isert_conn will be accidentally removed while it is running. (Drop unnecessary sleep_on_conn_wait_comp check in isert_cq_rx_comp_err - nab) Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-19Target/iser: Bail from accept_np if np_thread is trying to closeSagi Grimberg
In case np_thread state is in RESET/SHUTDOWN/EXIT states, no point for isert to stall there as we may get a hang in case no one will wake it up later. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-17target: fix memory leak on XCOPYMikulas Patocka
On each processed XCOPY command, two "kmalloc-512" memory objects are leaked. These represent two allocations of struct xcopy_pt_cmd in target_core_xcopy.c. The reason for the memory leak is that the cmd_kref field is not initialized (thus, it is zero because the allocations were done with kzalloc). When we decrement zero kref in target_put_sess_cmd, the result is not zero, thus target_release_cmd_kref is not called. This patch fixes the bug by moving kref initialization from target_get_sess_cmd to transport_init_se_cmd (this function is called from target_core_xcopy.c, so it will correctly initialize cmd_kref). It can be easily verified that all code that calls target_get_sess_cmd also calls transport_init_se_cmd earlier, thus moving kref_init shouldn't introduce any new problems. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: stable@vger.kernel.org # 3.12+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-16target: Don't allow setting WC emulation if device doesn't supportAndy Grover
Just like for pSCSI, if the transport sets get_write_cache, then it is not valid to enable write cache emulation for it. Return an error. see https://bugzilla.redhat.com/show_bug.cgi?id=1082675 Reviewed-by: Chris Leech <cleech@redhat.com> Signed-off-by: Andy Grover <agrover@redhat.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-16iscsi-target: Disable Immediate + Unsolicited Data with ISER ProtectionNicholas Bellinger
This patch explicitly disables Immediate + Unsolicited Data for ISER connections during login in iscsi_login_zero_tsih_s2() when protection has been enabled for the session by the underlying hardware. This is currently required because protection / signature memory regions (MRs) expect T10 PI to occur on RDMA READs + RDMA WRITEs transfers, and not on a immediate data payload associated with ISCSI_OP_SCSI_CMD, or unsolicited data-out associated with a ISCSI_OP_SCSI_DATA_OUT. v2 changes: - Add TARGET_PROT_DOUT_INSERT check (Sagi) - Add pr_debug noisemaker (Sagi) - Add goto to avoid early return from MRDSL check (nab) Cc: Sagi Grimberg <sagig@mellanox.com> Cc: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-16tcm_fc: Fix free-after-use regression in ft_free_cmdNicholas Bellinger
This patch fixes a free-after-use regression in ft_free_cmd(), where ft_sess_put() is called with cmd->sess after percpu_ida_free() has already released the tag. Fix this bug by saving the ft_sess pointer ahead of percpu_ida_free(), and pass it directly to ft_sess_put(). The regression was originally introduced in v3.13-rc1 commit: commit 5f544cfac956971099e906f94568bc3fd1a7108a Author: Nicholas Bellinger <nab@daterainc.com> Date: Mon Sep 23 12:12:42 2013 -0700 tcm_fc: Convert to per-cpu command map pre-allocation of ft_cmd Reported-by: Jun Wu <jwu@stormojo.com> Cc: Mark Rustad <mark.d.rustad@intel.com> Cc: Robert Love <robert.w.love@intel.com> Cc: <stable@vger.kernel.org> #3.13+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-16iscsi-target: Change BUG_ON to REJECT in iscsit_process_nop_outNicholas Bellinger
This patch changes an incorrect use of BUG_ON to instead generate a REJECT + PROTOCOL_ERROR in iscsit_process_nop_out() code. This case can occur with traditional TCP where a flood of zeros in the data stream can reach this block for what is presumed to be a NOP-OUT with a solicited reply, but without a valid iscsi_cmd pointer. This incorrect BUG_ON was introduced during the v3.11-rc timeframe with the following commit: commit 778de368964c5b7e8100cde9f549992d521e9c89 Author: Nicholas Bellinger <nab@linux-iscsi.org> Date: Fri Jun 14 16:07:47 2013 -0700 iscsi/isert-target: Refactor ISCSI_OP_NOOP RX handling Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com> Cc: stable@vger.kernel.org # 3.11+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-16Target/iscsi,iser: Avoid accepting transport connections during stop stageSagi Grimberg
When the target is in stop stage, iSER transport initiates RDMA disconnects. The iSER initiator may wish to establish a new connection over the still existing network portal. In this case iSER transport should not accept and resume new RDMA connections. In order to learn that, iscsi_np is added with enabled flag so the iSER transport can check when deciding weather to accept and resume a new connection request. The iscsi_np is enabled after successful transport setup, and disabled before iscsi_np login threads are cleaned up. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-16Target/iser: Fix iscsit_accept_np and rdma_cm racy flowSagi Grimberg
RDMA CM and iSCSI target flows are asynchronous and completely uncorrelated. Relying on the fact that iscsi_accept_np will be called after CM connection request event and will wait for it is a mistake. When attempting to login to a few targets this flow is racy and unpredictable, but for parallel login to dozens of targets will race and hang every time. The correct synchronizing mechanism in this case is pending on a semaphore rather than a wait_for_event. We keep the pending interruptible for iscsi_np cleanup stage. (Squash patch to remove dead code into parent - nab) Reported-by: Slava Shwartsman <valyushash@gmail.com> Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-16Target/iser: Fix wrong connection requests list additionSagi Grimberg
Should be adding list_add_tail($new, $head) and not the other way around. Signed-off-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-05-16target: Allow non-supporting backends to set pi_prot_type to 0Andy Grover
Userspace tools assume if a value is read from configfs, it is valid and will not cause an error if the same value is written back. The only valid value for pi_prot_type for backends not supporting DIF is 0, so allow this particular value to be set without returning an error. Reported-by: Krzysztof Chojnowski <frirajder@gmail.com> Signed-off-by: Andy Grover <agrover@redhat.com> Reviewed-by: Sagi Grimberg <sagig@mellanox.com> Cc: stable@vger.kernel.org # 3.14+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-27Merge branch 'irq-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A slighlty large fix for a subtle issue in the CPU hotplug code of certain ARM SoCs, where the not yet online cpu needs to setup the cpu local timer and needs to set the interrupt affinity to itself. Setting interrupt affinity to a not online cpu is prohibited and therefor the timer interrupt ends up on the wrong cpu, which leads to nasty complications. The SoC folks tried to hack around that in the SoC code in some more than nasty ways. The proper solution is to have a way to enforce the affinity setting to a not online cpu. The core patch to the genirq code provides that facility and the follow up patches make use of it in the GIC interrupt controller and the exynos timer driver. The change to the core code has no implications to existing users, except for the rename of the locked function and therefor the necessary fixup in mips/cavium. Aside of that, no runtime impact is possible, as none of the existing interrupt chips implements anything which depends on the force argument of the irq_set_affinity() callback" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource: Exynos_mct: Register clock event after request_irq() clocksource: Exynos_mct: Use irq_force_affinity() in cpu bringup irqchip: Gic: Support forced affinity setting genirq: Allow forcing cpu affinity of interrupts
2014-04-27Merge tag 'tty-3.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are a few tty/serial fixes for 3.15-rc3 that resolve a number of reported issues in the 8250 and samsung serial drivers, as well as a character loss fix for the tty core that was caused by the lock removal patches a release ago" * tag 'tty-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial_core: fix uart PORT_UNKNOWN handling serial: samsung: Change barrier() to cpu_relax() in console output serial: samsung: don't check config for every character serial: samsung: Use the passed in "port", fixing kgdb w/ no console serial: 8250: Fix thread unsafe __dma_tx_complete function 8250_core: Fix unwanted TX chars write tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc
2014-04-27Merge tag 'staging-3.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging / IIO driver fixes from Greg KH: "Here are some small staging and IIO driver fixes for 3.15-rc3. Nothing major at all, just some assorted issues that people have reported" * tag 'staging-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private data iio: adc: mxs-lradc: fix warning when buidling on avr32 iio: cm36651: Fix i2c client leak and possible NULL pointer dereference iio: querying buffer scan_mask should return 0/1 staging:iio:ad2s1200 fix a missing break iio: adc: at91_adc: correct default shtim value ARM: at91: at91sam9260: change at91_adc name ARM: at91: at91sam9g45: change at91_adc name iio: cm32181: Fix read integration time function iio: adc: at91_adc: Repair broken platform_data support
2014-04-27Merge tag 'usb-3.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of USB fixes for 3.15-rc3. The majority are gadget fixes, as we didn't get any of those in for 3.15-rc2. The others are all over the place, and there's a number of new device id addtions as well." * tag 'usb-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (35 commits) usb: option: add and update a number of CMOTech devices usb: option: add Alcatel L800MA usb: option: add Olivetti Olicard 500 usb: qcserial: add Sierra Wireless MC7305/MC7355 usb: qcserial: add Sierra Wireless MC73xx usb: qcserial: add Sierra Wireless EM7355 USB: io_ti: fix firmware download on big-endian machines usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM xhci: extend quirk for Renesas cards xhci: Switch Intel Lynx Point ports to EHCI on shutdown. usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb phy: core: make NULL a valid phy reference if !CONFIG_GENERIC_PHY phy: fix kernel oops in phy_lookup() phy: restore OMAP_CONTROL_PHY dependencies phy: exynos: fix building as a module USB: serial: fix sysfs-attribute removal deadlock usb: wusbcore: fix panic in wusbhc_chid_set usb: wusbcore: convert nested lock to use spin_lock instead of spin_lock_irq uwb: don't call spin_unlock_irq in a USB completion handler usb: chipidea: coordinate usb phy initialization for different phy type ...
2014-04-27Merge tag 'pm+acpi-3.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI and power management fixes from Rafael Wysocki: "These include a fix for a recent ACPI regression related to device notifications, intel_idle fix related to IvyTown support, fix for a buffer size issue in ACPICA, PM core fix related to the "freeze" sleep state, four fixes for various types of breakage in cpufreq drivers, a PNP workaround for a wrong memory region size in ACPI tables, and a fix and cleanup for the ACPI tools Makefile. Specifics: - Fix for broken ACPI notifications on some systems caused by a recent ACPI hotplug commit that blocked the propagation of unknown type notifications to device drivers inadvertently. - intel_idle fix to make the IvyTown C-states handling (added recently) work as intended which now is broken due to missing braces. From Christoph Jaeger. - ACPICA fix to make it allocate buffers of the right sizes for the Generic Serial Bus operation region access. From Lv Zheng. - PM core fix unblocking cpuidle before entering the "freeze" sleep state which causes that state to be able to actually save more energy than runtime idle. - Configuration and build fixes for the highbank and powernv cpufreq drivers from Kefeng Wang and Srivatsa S Bhat. - Coccinelle warning fix related to error pointers for the unicore32 cpufreq driver from Duan Jiong. - Integer overflow fix for the ppc-corenet cpufreq driver from Geert Uytterhoeven. - Workaround for BIOSes that don't report the entire Intel MCH area in their ACPI tables from Bjorn Helgaas. - ACPI tools Makefile fix and cleanup from Thomas Renninger" * tag 'pm+acpi-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / notify: Do not block unknown type notifications in root handler PNP: Work around BIOS defects in Intel MCH area reporting cpufreq: highbank: fix ARM_HIGHBANK_CPUFREQ dependency warning cpufreq: ppc: Fix integer overflow in expression cpufreq, powernv: Fix build failure on UP cpufreq: unicore32: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO PM / suspend: Make cpuidle work in the "freeze" state intel_idle: fix IVT idle state table setting ACPICA: Fix buffer allocation issue for generic_serial_bus region accesses. tools/power/acpi: Minor bugfixes
2014-04-25Merge branches 'pnp' and 'acpi-hotplug'Rafael J. Wysocki
* pnp: PNP: Work around BIOS defects in Intel MCH area reporting * acpi-hotplug: ACPI / notify: Do not block unknown type notifications in root handler
2014-04-25Merge tag 'hwmon-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ltc2945: Don't unecessarily crash kernel on implementation error - vexpress: Fix 'name' and 'label' attributes * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ltc2945) Don't crash the kernel unnecessarily hwmon: (vexpress) Avoid creating non-existing attributes hwmon: (vexpress) Use legal hwmon device names
2014-04-25Merge tag 'scsi-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of seven fixes, three (hpsa) and free'd command references correcting bugs in the last round of updates and the remaining four correcting problems within the SCSI error handler that was causing a deadlock within USB" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: [SCSI] More USB deadlock fixes [SCSI] Fix USB deadlock caused by SCSI error handling [SCSI] Fix command result state propagation [SCSI] Fix spurious request sense in error handling [SCSI] don't reference freed command in scsi_prep_return [SCSI] don't reference freed command in scsi_init_sgtable [SCSI] hpsa: fix NULL dereference in hpsa_put_ctlr_into_performant_mode()
2014-04-25Merge tag 'fixes-3.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: "Since we didn't get around to collect fixes in time for -rc2 over the easter vacation, this one is unfortunately a bit larger than we'd like for an -rc3 merge. A large set of the changes is in the device tree sources, so I'm splitting out the description between code changes and DT changes. Aside from omap and versatile express, the actual code bugs are and trivial. Here is an overview: imx: - fix video clock settings - fix one clock refcounting bug omap: - update defconfig for renamed USB PHY driver - fix error handling in gpmc - fix N900 video initialization regression - fix reression in hwmod code from missing braces - fix am43xx and omap3 clocks - remove bogus write to voltage control register pxa: - fix build regression from 3.13 header cleanup rockchip: - fix a misleading printk string shmobile: - fix incorrect sound setting on multiple machines spear: - remove incorrect __init section annotation tegra: - remove a stale Kconfig entry u300: - update defconfig ux500: - enable common wireless and sensor drivers in defconfig - more defconfig updates vexpress: - fix voltage calculation for opp - fix reboot hang and warning - fix out-of-bounds array access - improve error handling in clock driver overall: - always select CLKSRC_OF in multiplatform builds And these are the devicetree related changes: imx: - add missing #clock-cell properties - fix pinctrl setting in imx6sl-evk - fix video endpoint on imx53 - remove obsolete lvds-channel nodes (multiple patches) - add missing second stmpe node - fix usb host mode on dmo-edmqmx6 (multiple patches) - fix gic node #address-cells to match usage - add missing legacy IRQ map for PCIe - fix microsom pincontrol setting for rgmii - fix fatal typo in touchscreen DT usage for mx5 - list all RAM present on m53evk and mx53qsb omap: - fix bug in DT handling of gpmc external bus - add DT for older revision of beagleboard - fix regression after DT node name fixes - remove obsolete properties for gpmc - fix pinmux comment to match DT it refers to - fix newly added dra7xx clock node data - add missing clock for USB PHY mvebu: - add missing clock for mdio node - fix nonstandard vendor prefixes on i2c nodes rockchip: - fix pin control setting for uart shmobile: - fix typo in DT data for pin control (multiple patches) - fix gic node #address-cells to match usage tegra: - fix clock and uart DT representation to match hardware zynq: - add DT nodes for newly added driver - add DT properties required for cpufreq-ondemand overall: - restore alphabetic order in Makefile - grammar fixes in bindings" * tag 'fixes-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (66 commits) ARM: vexpress/TC2: Convert OPP voltage to uV before storing power/reset: vexpress: Fix restart/power off operation dt: tegra: remove non-existent clock IDs clk: tegra: remove non-existent clocks ARM: tegra: remove UART5/UARTE from tegra124.dtsi ARM: tegra: remove TEGRA_EMC_SCALING_ENABLE ARM: Tidy up DTB Makefile entries ARM: fix missing CLKSRC_OF on multi-platform ARM: spear: add __init to spear_clocksource_init() ARM: pxa: hx4700.h: include "irqs.h" for PXA_NR_BUILTIN_GPIO arm/mach-vexpress: array accessed out of bounds clk: vexpress: NULL dereference on error path ARM: OMAP2+: Fix GPMC remap for devices using an offset ARM: zynq: dt: Add I2C nodes to Zynq device tree ARM: zynq: DT: Add 'clock-latency' property ARM: OMAP2+: Fix oops for GPMC free ARM: dts: Add support for the BeagleBoard xM A/B ARM: dts: Grammar /that will/it will/ ARM: dts: Grammar /is uses/ is used/ ARM: OMAP2+: Fix config name for USB3 PHY ...
2014-04-25usb: option: add and update a number of CMOTech devicesBjørn Mork
A number of older CMOTech modems are based on Qualcomm chips. The blacklisted interfaces are QMI/wwan. Reported-by: Lars Melin <larsm17@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25usb: option: add Alcatel L800MABjørn Mork
Device interface layout: 0: ff/ff/ff - serial 1: ff/00/00 - serial AT+PPP 2: ff/ff/ff - QMI/wwan 3: 08/06/50 - storage Cc: <stable@vger.kernel.org> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>