linux/drivers/target, branch v6.4

scsi: target: core: Fix error path in target_setup_session()

2023-06-15T01:54:35Z

In the error exits in target_setup_session(), if a branch is taken to free_sess: transport_free_session() may call to target_free_cmd_counter() and then fall through to call target_free_cmd_counter() a second time. This can, and does, sometimes cause seg faults since the data field in cmd_cnt->refcnt has been freed in the first call. Fix this problem by simply returning after the call to transport_free_session(). The second call is redundant for those cases. Fixes: 4edba7e4a8f3 ("scsi: target: Move cmd counter allocation") Signed-off-by: Bob Pearson Link: https://lore.kernel.org/r/20230613144259.12890-1-rpearsonhpe@gmail.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen

scsi: target: iscsi: Prevent login threads from racing between each other

2023-05-22T20:29:39Z

The tpg->np_login_sem is a semaphore that is used to serialize the login process when multiple login threads run concurrently against the same target portal group. The iscsi_target_locate_portal() function finds the tpg, calls iscsit_access_np() against the np_login_sem semaphore and saves the tpg pointer in conn->tpg; If iscsi_target_locate_portal() fails, the caller will check for the conn->tpg pointer and, if it's not NULL, then it will assume that iscsi_target_locate_portal() called iscsit_access_np() on the semaphore. Make sure that conn->tpg gets initialized only if iscsit_access_np() was successful, otherwise iscsit_deaccess_np() may end up being called against a semaphore we never took, allowing more than one thread to access the same tpg. Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20230508162219.1731964-4-mlombard@redhat.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen

scsi: target: iscsi: Fix hang in the iSCSI login code

2023-05-22T20:29:39Z

If the initiator suddenly stops sending data during a login while keeping the TCP connection open, the login_work won't be scheduled and will never release the login semaphore; concurrent login operations will therefore get stuck and fail. The bug is due to the inability of the login timeout code to properly handle this particular case. Fix the problem by replacing the old per-NP login timer with a new per-connection timer. The timer is started when an initiator connects to the target; if it expires, it sends a SIGINT signal to the thread pointed at by the conn->login_kworker pointer. conn->login_kworker is set by calling the iscsit_set_login_timer_kworker() helper, initially it will point to the np thread; When the login operation's control is in the process of being passed from the NP-thread to login_work, the conn->login_worker pointer is set to NULL. Finally, login_kworker will be changed to point to the worker thread executing the login_work job. If conn->login_kworker is NULL when the timer expires, it means that the login operation hasn't been completed yet but login_work isn't running, in this case the timer will mark the login process as failed and will schedule login_work so the latter will be forced to free the resources it holds. Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20230508162219.1731964-2-mlombard@redhat.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen

scsi: target: core: Fix invalid memory access

2023-04-12T00:49:43Z

nr_attrs should start counting from zero, otherwise we will end up dereferencing an invalid memory address. $ targetcli /loopback create general protection fault RIP: 0010:configfs_create_file+0x12/0x70 Call Trace: configfs_attach_item.part.0+0x5f/0x150 configfs_attach_group.isra.0+0x49/0x120 configfs_mkdir+0x24f/0x4d0 vfs_mkdir+0x192/0x240 do_mkdirat+0x131/0x160 __x64_sys_mkdir+0x48/0x70 do_syscall_64+0x5c/0x90 Fixes: 31177b74790c ("scsi: target: core: Add RTPI attribute for target port") Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20230407130033.556644-1-mlombard@redhat.com Acked-by: Dmitry Bogdanov Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen

scsi: target: core: Remove unused 'prod_len' variable

2023-04-03T01:35:52Z

clang with W=1 reports: drivers/target/target_core_spc.c:229:6: error: variable 'prod_len' set but not used [-Werror,-Wunused-but-set-variable] u32 prod_len; ^ This variable is not used so remove it. Signed-off-by: Tom Rix Link: https://lore.kernel.org/r/20230329132421.1809362-1-trix@redhat.com Reviewed-by: Chaitanya Kulkarni Signed-off-by: Martin K. Petersen

Merge branch '6.3/scsi-fixes' into 6.4/scsi-staging

2023-04-01T01:45:14Z

Pull in the fixes branch to resolve an mpi3mr conflict reported by sfr. Signed-off-by: Martin K. Petersen

scsi: target: tcm_loop: Remove redundant driver match function

2023-03-25T00:44:14Z

If there is no driver match function, the driver core assumes that each candidate pair (driver, device) matches. See driver_match_device(). pseudo_lld_bus_match() always returns 1 and is therefore equivalent to not registering a match function. Remove it. Signed-off-by: Lizhe Link: https://lore.kernel.org/r/20230319043518.297490-1-sensor1010@163.com Signed-off-by: Martin K. Petersen

Merge patch series "Constify most SCSI host templates"

2023-03-25T00:13:03Z

Bart Van Assche says: It helps humans and the compiler if it is made explicit that SCSI host templates are not modified. Hence this patch series that constifies most SCSI host templates. Please consider this patch series for the next merge window. Link: https://lore.kernel.org/r/20230322195515.1267197-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen

scsi: target: tcm-loop: Declare SCSI host template const

2023-03-24T23:20:00Z

Make it explicit that the SCSI host template is not modified. Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20230322195515.1267197-79-bvanassche@acm.org Signed-off-by: Martin K. Petersen

Merge patch series "target: TMF and recovery fixes"

2023-03-24T21:39:15Z

Mike Christie says: The following patches apply over Martin's 6.4 branches and Linus's tree. They fix a couple regressions in iscsit that occur when there are TMRs executing and a connection is closed. It also includes Dimitry's fixes in related code paths for cmd cleanup when ERL2 is used and the write pending hang during conn cleanup. This version of the patchset brings it back to just regressions and fixes for bugs we have a lot of users hitting. I'm going to fix isert and get it hooked into iscsit properly in a second patchset, because this one was getting so large. I've also moved my cleanup type of patches for a 3rd patchset. Link: https://lore.kernel.org/r/20230319015620.96006-1-michael.christie@oracle.com Signed-off-by: Martin K. Petersen