1 files changed, 36 insertions, 44 deletions

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 9e67c7678c86..9eb10d34682c 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -502,7 +502,7 @@ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
 EXPORT_SYMBOL(iscsit_aborted_task);
 
 static void iscsit_do_crypto_hash_buf(struct ahash_request *, const void *,
-                                      u32, u32, u8 *, u8 *);
+                                      u32, u32, const void *, void *);
 static void iscsit_tx_thread_wait_for_tcp(struct iscsi_conn *);
 
 static int
@@ -523,7 +523,7 @@ iscsit_xmit_nondatain_pdu(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 
                 iscsit_do_crypto_hash_buf(conn->conn_tx_hash, hdr,
                                           ISCSI_HDR_LEN, 0, NULL,
-                                          (u8 *)header_digest);
+                                          header_digest);
 
                 iov[0].iov_len += ISCSI_CRC_LEN;
                 tx_size += ISCSI_CRC_LEN;
@@ -550,9 +550,8 @@ iscsit_xmit_nondatain_pdu(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
                 if (conn->conn_ops->DataDigest) {
                         iscsit_do_crypto_hash_buf(conn->conn_tx_hash,
                                                   data_buf, data_buf_len,
-                                                  padding,
-                                                  (u8 *)&cmd->pad_bytes,
-                                                  (u8 *)&cmd->data_crc);
+                                                  padding, &cmd->pad_bytes,
+                                                  &cmd->data_crc);
 
                         iov[niov].iov_base = &cmd->data_crc;
                         iov[niov++].iov_len = ISCSI_CRC_LEN;
@@ -597,7 +596,7 @@ iscsit_xmit_datain_pdu(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 
                 iscsit_do_crypto_hash_buf(conn->conn_tx_hash, cmd->pdu,
                                           ISCSI_HDR_LEN, 0, NULL,
-                                          (u8 *)header_digest);
+                                          header_digest);
 
                 iov[0].iov_len += ISCSI_CRC_LEN;
                 tx_size += ISCSI_CRC_LEN;
@@ -836,6 +835,7 @@ static int iscsit_add_reject_from_cmd(
         unsigned char *buf)
 {
         struct iscsi_conn *conn;
+        const bool do_put = cmd->se_cmd.se_tfo != NULL;
 
         if (!cmd->conn) {
                 pr_err("cmd->conn is NULL for ITT: 0x%08x\n",
@@ -866,7 +866,7 @@ static int iscsit_add_reject_from_cmd(
          * Perform the kref_put now if se_cmd has already been setup by
          * scsit_setup_scsi_cmd()
          */
-        if (cmd->se_cmd.se_tfo != NULL) {
+        if (do_put) {
                 pr_debug("iscsi reject: calling target_put_sess_cmd >>>>>>\n");
                 target_put_sess_cmd(&cmd->se_cmd);
         }
@@ -1410,13 +1410,9 @@ static u32 iscsit_do_crypto_hash_sg(
         return data_crc;
 }
 
-static void iscsit_do_crypto_hash_buf(
-        struct ahash_request *hash,
-        const void *buf,
-        u32 payload_length,
-        u32 padding,
-        u8 *pad_bytes,
-        u8 *data_crc)
+static void iscsit_do_crypto_hash_buf(struct ahash_request *hash,
+        const void *buf, u32 payload_length, u32 padding,
+        const void *pad_bytes, void *data_crc)
 {
         struct scatterlist sg[2];
 
@@ -1462,9 +1458,9 @@ __iscsit_check_dataout_hdr(struct iscsi_conn *conn, void *buf,
         iscsit_mod_dataout_timer(cmd);
 
         if ((be32_to_cpu(hdr->offset) + payload_length) > cmd->se_cmd.data_length) {
-                pr_err("DataOut Offset: %u, Length %u greater than"
-                        " iSCSI Command EDTL %u, protocol error.\n",
-                        hdr->offset, payload_length, cmd->se_cmd.data_length);
+                pr_err("DataOut Offset: %u, Length %u greater than iSCSI Command EDTL %u, protocol error.\n",
+                       be32_to_cpu(hdr->offset), payload_length,
+                       cmd->se_cmd.data_length);
                 return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_INVALID, buf);
         }
 
@@ -1878,10 +1874,9 @@ static int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
                 }
 
                 if (conn->conn_ops->DataDigest) {
-                        iscsit_do_crypto_hash_buf(conn->conn_rx_hash,
-                                        ping_data, payload_length,
-                                        padding, cmd->pad_bytes,
-                                        (u8 *)&data_crc);
+                        iscsit_do_crypto_hash_buf(conn->conn_rx_hash, ping_data,
+                                                  payload_length, padding,
+                                                  cmd->pad_bytes, &data_crc);
 
                         if (checksum != data_crc) {
                                 pr_err("Ping data CRC32C DataDigest"
@@ -1962,7 +1957,6 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         struct iscsi_tmr_req *tmr_req;
         struct iscsi_tm *hdr;
         int out_of_order_cmdsn = 0, ret;
-        bool sess_ref = false;
         u8 function, tcm_function = TMR_UNKNOWN;
 
         hdr                     = (struct iscsi_tm *) buf;
@@ -1995,22 +1989,23 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 
         cmd->data_direction = DMA_NONE;
         cmd->tmr_req = kzalloc(sizeof(*cmd->tmr_req), GFP_KERNEL);
-        if (!cmd->tmr_req)
+        if (!cmd->tmr_req) {
                 return iscsit_add_reject_cmd(cmd,
                                              ISCSI_REASON_BOOKMARK_NO_RESOURCES,
                                              buf);
+        }
+
+        transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops,
+                              conn->sess->se_sess, 0, DMA_NONE,
+                              TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
+
+        target_get_sess_cmd(&cmd->se_cmd, true);
 
         /*
          * TASK_REASSIGN for ERL=2 / connection stays inside of
          * LIO-Target $FABRIC_MOD
          */
         if (function != ISCSI_TM_FUNC_TASK_REASSIGN) {
-                transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops,
-                                      conn->sess->se_sess, 0, DMA_NONE,
-                                      TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
-
-                target_get_sess_cmd(&cmd->se_cmd, true);
-                sess_ref = true;
                 tcm_function = iscsit_convert_tmf(function);
                 if (tcm_function == TMR_UNKNOWN) {
                         pr_err("Unknown iSCSI TMR Function:"
@@ -2101,12 +2096,14 @@ attach:
 
         if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
                 int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
-                if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP)
+                if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP) {
                         out_of_order_cmdsn = 1;
-                else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
+                } else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+                        target_put_sess_cmd(&cmd->se_cmd);
                         return 0;
-                else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+                } else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
                         return -1;
+                }
         }
         iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
 
@@ -2126,12 +2123,8 @@ attach:
          * For connection recovery, this is also the default action for
          * TMR TASK_REASSIGN.
          */
-        if (sess_ref) {
-                pr_debug("Handle TMR, using sess_ref=true check\n");
-                target_put_sess_cmd(&cmd->se_cmd);
-        }
-
         iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
+        target_put_sess_cmd(&cmd->se_cmd);
         return 0;
 }
 EXPORT_SYMBOL(iscsit_handle_task_mgt_cmd);
@@ -2287,10 +2280,9 @@ iscsit_handle_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
                         goto reject;
 
                 if (conn->conn_ops->DataDigest) {
-                        iscsit_do_crypto_hash_buf(conn->conn_rx_hash,
-                                        text_in, payload_length,
-                                        padding, (u8 *)&pad_bytes,
-                                        (u8 *)&data_crc);
+                        iscsit_do_crypto_hash_buf(conn->conn_rx_hash, text_in,
+                                                  payload_length, padding,
+                                                  &pad_bytes, &data_crc);
 
                         if (checksum != data_crc) {
                                 pr_err("Text data CRC32C DataDigest"
@@ -3978,9 +3970,9 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                                 return;
                         }
 
-                        iscsit_do_crypto_hash_buf(conn->conn_rx_hash,
-                                        buffer, ISCSI_HDR_LEN,
-                                        0, NULL, (u8 *)&checksum);
+                        iscsit_do_crypto_hash_buf(conn->conn_rx_hash, buffer,
+                                                  ISCSI_HDR_LEN, 0, NULL,
+                                                  &checksum);
 
                         if (digest != checksum) {
                                 pr_err("HeaderDigest CRC32C failed,"