1. 03 Dec, 2015 3 commits
  2. 01 Dec, 2015 1 commit
  3. 30 Nov, 2015 28 commits
  4. 29 Nov, 2015 8 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · 36511e86
      Linus Torvalds authored
      Pull SCSI target fixes from Nicholas Bellinger:
       - fix tcm-user backend driver expired cmd time processing (agrover)
       - eliminate kref_put_spinlock_irqsave() for I/O completion (bart)
       - fix iscsi login kthread failure case hung task regression (nab)
       - fix COMPARE_AND_WRITE completion use-after-free race (nab)
       - fix COMPARE_AND_WRITE with SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC non zero
         SGL offset data corruption.  (Jan + Doug)
       - fix >= v4.4-rc1 regression for tcm_qla2xxx enable configfs attribute
         (Himanshu + HCH)
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        target/stat: print full t10_wwn.model buffer
        target: fix COMPARE_AND_WRITE non zero SGL offset data corruption
        qla2xxx: Fix regression introduced by target configFS changes
        kref: Remove kref_put_spinlock_irqsave()
        target: Invoke release_cmd() callback without holding a spinlock
        target: Fix race for SCF_COMPARE_AND_WRITE_POST checking
        iscsi-target: Fix rx_login_comp hang after login failure
        iscsi-target: return -ENOMEM instead of -1 in case of failed kmalloc()
        target/user: Do not set unused fields in tcmu_ops
        target/user: Fix time calc in expired cmd processing
      36511e86
    • Linus Torvalds's avatar
      Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux · 75a29ec1
      Linus Torvalds authored
      Pull thermal management fixes from Zhang Rui:
       "Specifics:
      
       - several fixes and cleanups on Rockchip thermal drivers.
      
       - add the missing support of RK3368 SoCs in Rockchip driver.
      
       - small fixes on of-thermal, power_allocator, rcar driver, IMX, and
         QCOM drivers, and also compilation fixes, on thermal.h, when thermal
         is not selected"
      
      * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
        imx: thermal: use CPU temperature grade info for thresholds
        thermal: fix thermal_zone_bind_cooling_device prototype
        Revert "thermal: qcom_spmi: allow compile test"
        thermal: rcar_thermal: remove redundant operation
        thermal: of-thermal: Reduce log level for message when can't fine thermal zone
        thermal: power_allocator: Use temperature reading from tz
        thermal: rockchip: Support the RK3368 SoCs in thermal driver
        thermal: rockchip: consistently use int for temperatures
        thermal: rockchip: Add the sort mode for adc value increment or decrement
        thermal: rockchip: improve the conversion function
        thermal: rockchip: trivial: fix typo in commit
        thermal: rockchip: better to compatible the driver for different SoCs
        dt-bindings: rockchip-thermal: Support the RK3368 SoCs compatible
      75a29ec1
    • David Disseldorp's avatar
      target/stat: print full t10_wwn.model buffer · 8f903539
      David Disseldorp authored
      
      
      Cut 'n paste error saw it only process sizeof(t10_wwn.vendor) characters.
      
      Signed-off-by: default avatarDavid Disseldorp <ddiss@suse.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      8f903539
    • Jan Engelhardt's avatar
      target: fix COMPARE_AND_WRITE non zero SGL offset data corruption · d94e5a61
      Jan Engelhardt authored
      
      
      target_core_sbc's compare_and_write functionality suffers from taking
      data at the wrong memory location when writing a CAW request to disk
      when a SGL offset is non-zero.
      
      This can happen with loopback and vhost-scsi fabric drivers when
      SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is used to map existing user-space
      SGL memory into COMPARE_AND_WRITE READ/WRITE payload buffers.
      
      Given the following sample LIO subtopology,
      
      % targetcli ls /loopback/
      o- loopback ................................. [1 Target]
        o- naa.6001405ebb8df14a ....... [naa.60014059143ed2b3]
          o- luns ................................... [2 LUNs]
            o- lun0 ................ [iblock/ram0 (/dev/ram0)]
            o- lun1 ................ [iblock/ram1 (/dev/ram1)]
      % lsscsi -g
      [3:0:1:0]    disk    LIO-ORG  IBLOCK           4.0   /dev/sdc   /dev/sg3
      [3:0:1:1]    disk    LIO-ORG  IBLOCK           4.0   /dev/sdd   /dev/sg4
      
      the following bug can be observed in Linux 4.3 and 4.4~rc1:
      
      % perl -e 'print chr$_ for 0..255,reverse 0..255' >rand
      % perl -e 'print "\0" x 512' >zero
      % cat rand >/dev/sdd
      % sg_compare_and_write -i rand -D zero --lba 0 /dev/sdd
      % sg_compare_and_write -i zero -D rand --lba 0 /dev/sdd
      Miscompare reported
      % hexdump -Cn 512 /dev/sdd
      00000000  0f 0e 0d 0c 0b 0a 09 08  07 06 05 04 03 02 01 00
      00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
      *
      00000200
      
      Rather than writing all-zeroes as instructed with the -D file, it
      corrupts the data in the sector by splicing some of the original
      bytes in. The page of the first entry of cmd->t_data_sg includes the
      CDB, and sg->offset is set to a position past the CDB. I presume that
      sg->offset is also the right choice to use for subsequent sglist
      members.
      
      Signed-off-by: default avatarJan Engelhardt <jengelh@netitwork.de>
      Tested-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
      Cc: <stable@vger.kernel.org> # v3.12+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      d94e5a61
    • Himanshu Madhani's avatar
      qla2xxx: Fix regression introduced by target configFS changes · 3786dc45
      Himanshu Madhani authored
      this patch fixes following regression
      
       # targetcli
       [Errno 13] Permission denied: '/sys/kernel/config/target/qla2xxx/21:00:00:0e:1e:08:c7:20/tpgt_1/enable'
      
      Fixes: 2eafd729
      
       ("target: use per-attribute show and store methods")
      Signed-off-by: default avatarHimanshu Madhani <himanshu.madhani@qlogic.com>
      Signed-off-by: default avatarGiridhar Malavali <giridhar.malavali@qlogic.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      3786dc45
    • Bart Van Assche's avatar
      kref: Remove kref_put_spinlock_irqsave() · 3a66d7dc
      Bart Van Assche authored
      
      
      The last user is gone. Hence remove this function.
      
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Joern Engel <joern@logfs.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      3a66d7dc
    • Bart Van Assche's avatar
      target: Invoke release_cmd() callback without holding a spinlock · 9ff9d15e
      Bart Van Assche authored
      
      
      This patch fixes the following kernel warning because it avoids that
      IRQs are disabled while ft_release_cmd() is invoked (fc_seq_set_resp()
      invokes spin_unlock_bh()):
      
      WARNING: CPU: 3 PID: 117 at kernel/softirq.c:150 __local_bh_enable_ip+0xaa/0x110()
      Call Trace:
       [<ffffffff814f71eb>] dump_stack+0x4f/0x7b
       [<ffffffff8105e56a>] warn_slowpath_common+0x8a/0xc0
       [<ffffffff8105e65a>] warn_slowpath_null+0x1a/0x20
       [<ffffffff81062b2a>] __local_bh_enable_ip+0xaa/0x110
       [<ffffffff814ff229>] _raw_spin_unlock_bh+0x39/0x40
       [<ffffffffa03a7f94>] fc_seq_set_resp+0xe4/0x100 [libfc]
       [<ffffffffa02e604a>] ft_free_cmd+0x4a/0x90 [tcm_fc]
       [<ffffffffa02e6972>] ft_release_cmd+0x12/0x20 [tcm_fc]
       [<ffffffffa042bd66>] target_release_cmd_kref+0x56/0x90 [target_core_mod]
       [<ffffffffa042caf0>] target_put_sess_cmd+0xc0/0x110 [target_core_mod]
       [<ffffffffa042cb81>] transport_release_cmd+0x41/0x70 [target_core_mod]
       [<ffffffffa042d975>] transport_generic_free_cmd+0x35/0x420 [target_core_mod]
      
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Acked-by: default avatarJoern Engel <joern@logfs.org>
      Reviewed-by: default avatarAndy Grover <agrover@redhat.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Hannes Reinecke <hare@suse.de>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      9ff9d15e
    • Nicholas Bellinger's avatar
      target: Fix race for SCF_COMPARE_AND_WRITE_POST checking · 057085e5
      Nicholas Bellinger authored
      
      
      This patch addresses a race + use after free where the first
      stage of COMPARE_AND_WRITE in compare_and_write_callback()
      is rescheduled after the backend sends the secondary WRITE,
      resulting in second stage compare_and_write_post() callback
      completing in target_complete_ok_work() before the first
      can return.
      
      Because current code depends on checking se_cmd->se_cmd_flags
      after return from se_cmd->transport_complete_callback(),
      this results in first stage having SCF_COMPARE_AND_WRITE_POST
      set, which incorrectly falls through into second stage CAW
      processing code, eventually triggering a NULL pointer
      dereference due to use after free.
      
      To address this bug, pass in a new *post_ret parameter into
      se_cmd->transport_complete_callback(), and depend upon this
      value instead of ->se_cmd_flags to determine when to return
      or fall through into ->queue_status() code for CAW.
      
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: <stable@vger.kernel.org> # v3.12+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      057085e5