linux/drivers/target, branch v3.17

iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure

2014-09-17T20:44:01Z

In iscsi_copy_param_list() a failed iscsi_param_list memory allocation currently invokes iscsi_release_param_list() to cleanup, and will promptly trigger a NULL pointer dereference. Instead, go ahead and return for the first iscsi_copy_param_list() failure case. Found by coverity. Signed-off-by: Joern Engel Cc: # v3.1+ Signed-off-by: Nicholas Bellinger

iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid

2014-09-17T20:40:19Z

This patch fixes a bug in iscsit_logout_post_handler_diffcid() where a pointer used as storage for list_for_each_entry() was incorrectly being used to determine if no matching entry had been found. This patch changes iscsit_logout_post_handler_diffcid() to key off bool conn_found to determine if the function needs to exit early. Reported-by: Joern Engel Cc: # v3.1+ Signed-off-by: Nicholas Bellinger

target: Fix inverted logic in SE_DEV_ALUA_SUPPORT_STATE_STORE

2014-09-17T18:06:52Z

Fix inverted logic in SE_DEV_ALUA_SUPPORT_STATE_STORE for setting the supported ALUA access states via configfs, originally introduced in commit b0a382c5. A value of 1 should enable the support, not disable it. Signed-off-by: Sebastian Herbszt Cc: # v3.14+ Signed-off-by: Nicholas Bellinger

target: Fix user data segment multiplier in spc_emulate_evpd_b3()

2014-09-17T17:53:25Z

This patch fixes an apparent cut and paste error in spc_emulate_evpd_b3(), where lba_map_segment_size was being used twice for the Referrals VPD. Go ahead and set the correct user data segment multiplier instead of user data segment size. Signed-off-by: Sebastian Herbszt Signed-off-by: Nicholas Bellinger

iscsi-target: Ignore ICF_GOT_LAST_DATAOUT during Data-Out ITT lookup

2014-09-15T21:03:06Z

This patch adds a explicit check in iscsit_find_cmd_from_itt_or_dump() to ignore commands with ICF_GOT_LAST_DATAOUT set. This is done to address the case where an ITT is being reused for DataOUT, but the previous command with the same ITT has not yet been acknowledged by ExpStatSN and removed from the per connection command list. This issue was originally manifesting itself by referencing the previous command during ITT lookup, and subsequently hitting the check in iscsit_check_dataout_hdr() for ICF_GOT_LAST_DATAOUT, that resulted in the DataOUT PDU + associated payload being silently dumped. Reported-by: Arshad Hussain Tested-by: Arshad Hussain Signed-off-by: Nicholas Bellinger

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2014-08-07T03:10:32Z

Pull SCSI updates from James Bottomley: "This patch set consists of the usual driver updates (ufs, storvsc, pm8001 hpsa). It also has removal of the user space target driver code (everyone is using LIO now), a partial PCI MSI-X update, more multi-queue updates, conversion to 64 bit LUNs (so we could theoretically cope with any LUN returned by a device) and placeholder support for the ZBC device type (Shingle drives), plus an assortment of minor updates and bug fixes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (143 commits) scsi: do not issue SCSI RSOC command to Promise Vtrak E610f vmw_pvscsi: Use pci_enable_msix_exact() instead of pci_enable_msix() pm8001: Fix invalid return when request_irq() failed lpfc: Remove superfluous call to pci_disable_msix() isci: Use pci_enable_msix_exact() instead of pci_enable_msix() bfa: Use pci_enable_msix_exact() instead of pci_enable_msix() bfa: Cleanup bfad_setup_intr() function bfa: Do not call pci_enable_msix() after it failed once fnic: Use pci_enable_msix_exact() instead of pci_enable_msix() scsi: use short driver name for per-driver cmd slab caches scsi_debug: support scsi-mq, queues and locks Drivers: add blist flags scsi: ufs: fix endianness sparse warnings scsi: ufs: make undeclared functions static bnx2i: Update driver version to 2.7.10.1 pm8001: fix a memory leak in nvmd_resp pm8001: fix update_flash pm8001: fix a memory leak in flash_update pm8001: Cleaning up uninitialized variables pm8001: Fix to remove null pointer checks that could never happen ...

Merge branch 'for-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

2014-08-04T17:09:27Z

Pull percpu updates from Tejun Heo: - Major reorganization of percpu header files which I think makes things a lot more readable and logical than before. - percpu-refcount is updated so that it requires explicit destruction and can be reinitialized if necessary. This was pulled into the block tree to replace the custom percpu refcnting implemented in blk-mq. - In the process, percpu and percpu-refcount got cleaned up a bit * 'for-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu: (21 commits) percpu-refcount: implement percpu_ref_reinit() and percpu_ref_is_zero() percpu-refcount: require percpu_ref to be exited explicitly percpu-refcount: use unsigned long for pcpu_count pointer percpu-refcount: add helpers for ->percpu_count accesses percpu-refcount: one bit is enough for REF_STATUS percpu-refcount, aio: use percpu_ref_cancel_init() in ioctx_alloc() workqueue: stronger test in process_one_work() workqueue: clear POOL_DISASSOCIATED in rebind_workers() percpu: Use ALIGN macro instead of hand coding alignment calculation percpu: invoke __verify_pcpu_ptr() from the generic part of accessors and operations percpu: preffity percpu header files percpu: use raw_cpu_*() to define __this_cpu_*() percpu: reorder macros in percpu header files percpu: move {raw|this}_cpu_*() definitions to include/linux/percpu-defs.h percpu: move generic {raw|this}_cpu_*_N() definitions to include/asm-generic/percpu.h percpu: only allow sized arch overrides for {raw|this}_cpu_*() ops percpu: reorganize include/linux/percpu-defs.h percpu: move accessors from include/linux/percpu.h to percpu-defs.h percpu: include/asm-generic/percpu.h should contain only arch-overridable parts percpu: introduce arch_raw_cpu_ptr() ...

scsi: use 64-bit LUNs

2014-07-17T20:07:37Z

The SCSI standard defines 64-bit values for LUNs, and large arrays employing large or hierarchical LUN numbers become more and more common. So update the linux SCSI stack to use 64-bit LUN numbers. Signed-off-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Ewan Milne Signed-off-by: Christoph Hellwig

percpu-refcount: require percpu_ref to be exited explicitly

2014-06-28T12:10:14Z

Currently, a percpu_ref undoes percpu_ref_init() automatically by freeing the allocated percpu area when the percpu_ref is killed. While seemingly convenient, this has the following niggles. * It's impossible to re-init a released reference counter without going through re-allocation. * In the similar vein, it's impossible to initialize a percpu_ref count with static percpu variables. * We need and have an explicit destructor anyway for failure paths - percpu_ref_cancel_init(). This patch removes the automatic percpu counter freeing in percpu_ref_kill_rcu() and repurposes percpu_ref_cancel_init() into a generic destructor now named percpu_ref_exit(). percpu_ref_destroy() is considered but it gets confusing with percpu_ref_kill() while "exit" clearly indicates that it's the counterpart of percpu_ref_init(). All percpu_ref_cancel_init() users are updated to invoke percpu_ref_exit() instead and explicit percpu_ref_exit() calls are added to the destruction path of all percpu_ref users. Signed-off-by: Tejun Heo Acked-by: Benjamin LaHaise Cc: Kent Overstreet Cc: Christoph Lameter Cc: Benjamin LaHaise Cc: Nicholas A. Bellinger Cc: Li Zefan

iscsi-target: fix iscsit_del_np deadlock on unload

2014-06-28T06:23:35Z

On uniprocessor preemptible kernel, target core deadlocks on unload. The following events happen: * iscsit_del_np is called * it calls send_sig(SIGINT, np->np_thread, 1); * the scheduler switches to the np_thread * the np_thread is woken up, it sees that kthread_should_stop() returns false, so it doesn't terminate * the np_thread clears signals with flush_signals(current); and goes back to sleep in iscsit_accept_np * the scheduler switches back to iscsit_del_np * iscsit_del_np calls kthread_stop(np->np_thread); * the np_thread is waiting in iscsit_accept_np and it doesn't respond to kthread_stop The deadlock could be resolved if the administrator sends SIGINT signal to the np_thread with killall -INT iscsi_np The reproducible deadlock was introduced in commit db6077fd0b7dd41dc6ff18329cec979379071f87, but the thread-stopping code was racy even before. This patch fixes the problem. Using kthread_should_stop to stop the np_thread is unreliable, so we test np_thread_state instead. If np_thread_state equals ISCSI_NP_THREAD_SHUTDOWN, the thread exits. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Nicholas Bellinger