8 files changed, 96 insertions, 77 deletions

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 262ef1f23b38..d7705e5824fb 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -651,7 +651,7 @@ static int iscsit_add_reject(
         cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
         if (!cmd->buf_ptr) {
                 pr_err("Unable to allocate memory for cmd->buf_ptr\n");
-                iscsit_release_cmd(cmd);
+                iscsit_free_cmd(cmd, false);
                 return -1;
         }
 
@@ -697,7 +697,7 @@ int iscsit_add_reject_from_cmd(
         cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
         if (!cmd->buf_ptr) {
                 pr_err("Unable to allocate memory for cmd->buf_ptr\n");
-                iscsit_release_cmd(cmd);
+                iscsit_free_cmd(cmd, false);
                 return -1;
         }
 
@@ -1743,7 +1743,7 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         return 0;
 out:
         if (cmd)
-                iscsit_release_cmd(cmd);
+                iscsit_free_cmd(cmd, false);
 ping_out:
         kfree(ping_data);
         return ret;
@@ -2251,7 +2251,7 @@ iscsit_handle_logout_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         if (conn->conn_state != TARG_CONN_STATE_LOGGED_IN) {
                 pr_err("Received logout request on connection that"
                         " is not in logged in state, ignoring request.\n");
-                iscsit_release_cmd(cmd);
+                iscsit_free_cmd(cmd, false);
                 return 0;
         }
 
@@ -3665,7 +3665,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state
                 list_del(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
-                iscsit_free_cmd(cmd);
+                iscsit_free_cmd(cmd, false);
                 break;
         case ISTATE_SEND_NOPIN_WANT_RESPONSE:
                 iscsit_mod_nopin_response_timer(conn);
@@ -4122,7 +4122,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
 
                 iscsit_increment_maxcmdsn(cmd, sess);
 
-                iscsit_free_cmd(cmd);
+                iscsit_free_cmd(cmd, true);
 
                 spin_lock_bh(&conn->cmd_lock);
         }
diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
index ba6091bf93fc..45a5afd5ea13 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.c
+++ b/drivers/target/iscsi/iscsi_target_erl2.c
@@ -143,7 +143,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                         list_del(&cmd->i_conn_node);
                         cmd->conn = NULL;
                         spin_unlock(&cr->conn_recovery_cmd_lock);
-                        iscsit_free_cmd(cmd);
+                        iscsit_free_cmd(cmd, true);
                         spin_lock(&cr->conn_recovery_cmd_lock);
                 }
                 spin_unlock(&cr->conn_recovery_cmd_lock);
@@ -165,7 +165,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                         list_del(&cmd->i_conn_node);
                         cmd->conn = NULL;
                         spin_unlock(&cr->conn_recovery_cmd_lock);
-                        iscsit_free_cmd(cmd);
+                        iscsit_free_cmd(cmd, true);
                         spin_lock(&cr->conn_recovery_cmd_lock);
                 }
                 spin_unlock(&cr->conn_recovery_cmd_lock);
@@ -248,7 +248,7 @@ void iscsit_discard_cr_cmds_by_expstatsn(
                 iscsit_remove_cmd_from_connection_recovery(cmd, sess);
 
                 spin_unlock(&cr->conn_recovery_cmd_lock);
-                iscsit_free_cmd(cmd);
+                iscsit_free_cmd(cmd, true);
                 spin_lock(&cr->conn_recovery_cmd_lock);
         }
         spin_unlock(&cr->conn_recovery_cmd_lock);
@@ -302,7 +302,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
                 list_del(&cmd->i_conn_node);
 
                 spin_unlock_bh(&conn->cmd_lock);
-                iscsit_free_cmd(cmd);
+                iscsit_free_cmd(cmd, true);
                 spin_lock_bh(&conn->cmd_lock);
         }
         spin_unlock_bh(&conn->cmd_lock);
@@ -355,7 +355,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
 
                         list_del(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
-                        iscsit_free_cmd(cmd);
+                        iscsit_free_cmd(cmd, true);
                         spin_lock_bh(&conn->cmd_lock);
                         continue;
                 }
@@ -375,7 +375,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                      iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
                         list_del(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
-                        iscsit_free_cmd(cmd);
+                        iscsit_free_cmd(cmd, true);
                         spin_lock_bh(&conn->cmd_lock);
                         continue;
                 }
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index c2185fc31136..e38222191a33 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -758,9 +758,9 @@ static int iscsi_add_notunderstood_response(
         }
         INIT_LIST_HEAD(&extra_response->er_list);
 
-        strncpy(extra_response->key, key, strlen(key) + 1);
-        strncpy(extra_response->value, NOTUNDERSTOOD,
-                        strlen(NOTUNDERSTOOD) + 1);
+        strlcpy(extra_response->key, key, sizeof(extra_response->key));
+        strlcpy(extra_response->value, NOTUNDERSTOOD,
+                sizeof(extra_response->value));
 
         list_add_tail(&extra_response->er_list,
                         &param_list->extra_response_list);
@@ -1629,8 +1629,6 @@ int iscsi_decode_text_input(
 
                 if (phase & PHASE_SECURITY) {
                         if (iscsi_check_for_auth_key(key) > 0) {
-                                char *tmpptr = key + strlen(key);
-                                *tmpptr = '=';
                                 kfree(tmpbuf);
                                 return 1;
                         }
diff --git a/drivers/target/iscsi/iscsi_target_parameters.h b/drivers/target/iscsi/iscsi_target_parameters.h
index 915b06798505..a47046a752aa 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.h
+++ b/drivers/target/iscsi/iscsi_target_parameters.h
@@ -1,8 +1,10 @@
 #ifndef ISCSI_PARAMETERS_H
 #define ISCSI_PARAMETERS_H
 
+#include <scsi/iscsi_proto.h>
+
 struct iscsi_extra_response {
-        char key[64];
+        char key[KEY_MAXLEN];
         char value[32];
         struct list_head er_list;
 } ____cacheline_aligned;
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 2cc6c9a3ffb8..08a3bacef0c5 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -676,40 +676,56 @@ void iscsit_free_queue_reqs_for_conn(struct iscsi_conn *conn)
 
 void iscsit_release_cmd(struct iscsi_cmd *cmd)
 {
-        struct iscsi_conn *conn = cmd->conn;
-
-        iscsit_free_r2ts_from_list(cmd);
-        iscsit_free_all_datain_reqs(cmd);
-
         kfree(cmd->buf_ptr);
         kfree(cmd->pdu_list);
         kfree(cmd->seq_list);
         kfree(cmd->tmr_req);
         kfree(cmd->iov_data);
 
-        if (conn) {
+        kmem_cache_free(lio_cmd_cache, cmd);
+}
+
+static void __iscsit_free_cmd(struct iscsi_cmd *cmd, bool scsi_cmd,
+                              bool check_queues)
+{
+        struct iscsi_conn *conn = cmd->conn;
+
+        if (scsi_cmd) {
+                if (cmd->data_direction == DMA_TO_DEVICE) {
+                        iscsit_stop_dataout_timer(cmd);
+                        iscsit_free_r2ts_from_list(cmd);
+                }
+                if (cmd->data_direction == DMA_FROM_DEVICE)
+                        iscsit_free_all_datain_reqs(cmd);
+        }
+
+        if (conn && check_queues) {
                 iscsit_remove_cmd_from_immediate_queue(cmd, conn);
                 iscsit_remove_cmd_from_response_queue(cmd, conn);
         }
-
-        kmem_cache_free(lio_cmd_cache, cmd);
 }
 
-void iscsit_free_cmd(struct iscsi_cmd *cmd)
+void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
 {
+        struct se_cmd *se_cmd = NULL;
+        int rc;
         /*
          * Determine if a struct se_cmd is associated with
          * this struct iscsi_cmd.
          */
         switch (cmd->iscsi_opcode) {
         case ISCSI_OP_SCSI_CMD:
-                if (cmd->data_direction == DMA_TO_DEVICE)
-                        iscsit_stop_dataout_timer(cmd);
+                se_cmd = &cmd->se_cmd;
+                __iscsit_free_cmd(cmd, true, shutdown);
                 /*
                  * Fallthrough
                  */
         case ISCSI_OP_SCSI_TMFUNC:
-                transport_generic_free_cmd(&cmd->se_cmd, 1);
+                rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
+                if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
+                        __iscsit_free_cmd(cmd, true, shutdown);
+                        target_put_sess_cmd(se_cmd->se_sess, se_cmd);
+                }
                 break;
         case ISCSI_OP_REJECT:
                 /*
@@ -718,11 +734,19 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd)
                  * associated cmd->se_cmd needs to be released.
                  */
                 if (cmd->se_cmd.se_tfo != NULL) {
-                        transport_generic_free_cmd(&cmd->se_cmd, 1);
+                        se_cmd = &cmd->se_cmd;
+                        __iscsit_free_cmd(cmd, true, shutdown);
+
+                        rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
+                        if (!rc && shutdown && se_cmd->se_sess) {
+                                __iscsit_free_cmd(cmd, true, shutdown);
+                                target_put_sess_cmd(se_cmd->se_sess, se_cmd);
+                        }
                         break;
                 }
                 /* Fall-through */
         default:
+                __iscsit_free_cmd(cmd, false, shutdown);
                 cmd->release_cmd(cmd);
                 break;
         }
diff --git a/drivers/target/iscsi/iscsi_target_util.h b/drivers/target/iscsi/iscsi_target_util.h
index 4f8e01a47081..a4422659d049 100644
--- a/drivers/target/iscsi/iscsi_target_util.h
+++ b/drivers/target/iscsi/iscsi_target_util.h
@@ -29,7 +29,7 @@ extern void iscsit_remove_cmd_from_tx_queues(struct iscsi_cmd *, struct iscsi_co
 extern bool iscsit_conn_all_queues_empty(struct iscsi_conn *);
 extern void iscsit_free_queue_reqs_for_conn(struct iscsi_conn *);
 extern void iscsit_release_cmd(struct iscsi_cmd *);
-extern void iscsit_free_cmd(struct iscsi_cmd *);
+extern void iscsit_free_cmd(struct iscsi_cmd *, bool);
 extern int iscsit_check_session_usage_count(struct iscsi_session *);
 extern void iscsit_dec_session_usage_count(struct iscsi_session *);
 extern void iscsit_inc_session_usage_count(struct iscsi_session *);
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 1b1d544e927a..b11890d85120 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -153,6 +153,7 @@ static int fd_configure_device(struct se_device *dev)
                 struct request_queue *q = bdev_get_queue(inode->i_bdev);
                 unsigned long long dev_size;
 
+                fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev);
                 /*
                  * Determine the number of bytes from i_size_read() minus
                  * one (1) logical sector from underlying struct block_device
@@ -199,6 +200,7 @@ static int fd_configure_device(struct se_device *dev)
                         goto fail;
                 }
 
+                fd_dev->fd_block_size = FD_BLOCKSIZE;
                 /*
                  * Limit UNMAP emulation to 8k Number of LBAs (NoLB)
                  */
@@ -217,9 +219,7 @@ static int fd_configure_device(struct se_device *dev)
                 dev->dev_attrib.max_write_same_len = 0x1000;
         }
 
-        fd_dev->fd_block_size = dev->dev_attrib.hw_block_size;
-
-        dev->dev_attrib.hw_block_size = FD_BLOCKSIZE;
+        dev->dev_attrib.hw_block_size = fd_dev->fd_block_size;
         dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
         dev->dev_attrib.hw_queue_depth = FD_MAX_DEVICE_QUEUE_DEPTH;
 
@@ -694,11 +694,12 @@ static sector_t fd_get_blocks(struct se_device *dev)
          * to handle underlying block_device resize operations.
          */
         if (S_ISBLK(i->i_mode))
-                dev_size = (i_size_read(i) - fd_dev->fd_block_size);
+                dev_size = i_size_read(i);
         else
                 dev_size = fd_dev->fd_dev_size;
 
-        return div_u64(dev_size, dev->dev_attrib.block_size);
+        return div_u64(dev_size - dev->dev_attrib.block_size,
+                       dev->dev_attrib.block_size);
 }
 
 static struct sbc_ops fd_sbc_ops = {
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 4a793362309d..21e315874a54 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -65,7 +65,7 @@ static void transport_complete_task_attr(struct se_cmd *cmd);
 static void transport_handle_queue_full(struct se_cmd *cmd,
                 struct se_device *dev);
 static int transport_generic_get_mem(struct se_cmd *cmd);
-static void transport_put_cmd(struct se_cmd *cmd);
+static int transport_put_cmd(struct se_cmd *cmd);
 static void target_complete_ok_work(struct work_struct *work);
 
 int init_se_kmem_caches(void)
@@ -221,6 +221,7 @@ struct se_session *transport_init_session(void)
         INIT_LIST_HEAD(&se_sess->sess_list);
         INIT_LIST_HEAD(&se_sess->sess_acl_list);
         INIT_LIST_HEAD(&se_sess->sess_cmd_list);
+        INIT_LIST_HEAD(&se_sess->sess_wait_list);
         spin_lock_init(&se_sess->sess_cmd_lock);
         kref_init(&se_sess->sess_kref);
 
@@ -1943,7 +1944,7 @@ static inline void transport_free_pages(struct se_cmd *cmd)
  * This routine unconditionally frees a command, and reference counting
  * or list removal must be done in the caller.
  */
-static void transport_release_cmd(struct se_cmd *cmd)
+static int transport_release_cmd(struct se_cmd *cmd)
 {
         BUG_ON(!cmd->se_tfo);
 
@@ -1955,11 +1956,11 @@ static void transport_release_cmd(struct se_cmd *cmd)
          * If this cmd has been setup with target_get_sess_cmd(), drop
          * the kref and call ->release_cmd() in kref callback.
          */
-         if (cmd->check_release != 0) {
-                target_put_sess_cmd(cmd->se_sess, cmd);
-                return;
-        }
+         if (cmd->check_release != 0)
+                return target_put_sess_cmd(cmd->se_sess, cmd);
+
         cmd->se_tfo->release_cmd(cmd);
+        return 1;
 }
 
 /**
@@ -1968,7 +1969,7 @@ static void transport_release_cmd(struct se_cmd *cmd)
  *
  * This routine releases our reference to the command and frees it if possible.
  */
-static void transport_put_cmd(struct se_cmd *cmd)
+static int transport_put_cmd(struct se_cmd *cmd)
 {
         unsigned long flags;
 
@@ -1976,7 +1977,7 @@ static void transport_put_cmd(struct se_cmd *cmd)
         if (atomic_read(&cmd->t_fe_count) &&
             !atomic_dec_and_test(&cmd->t_fe_count)) {
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                return;
+                return 0;
         }
 
         if (cmd->transport_state & CMD_T_DEV_ACTIVE) {
@@ -1986,8 +1987,7 @@ static void transport_put_cmd(struct se_cmd *cmd)
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
         transport_free_pages(cmd);
-        transport_release_cmd(cmd);
-        return;
+        return transport_release_cmd(cmd);
 }
 
 void *transport_kmap_data_sg(struct se_cmd *cmd)
@@ -2152,13 +2152,15 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
         }
 }
 
-void transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
+int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
 {
+        int ret = 0;
+
         if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD)) {
                 if (wait_for_tasks && (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
                          transport_wait_for_tasks(cmd);
 
-                transport_release_cmd(cmd);
+                ret = transport_release_cmd(cmd);
         } else {
                 if (wait_for_tasks)
                         transport_wait_for_tasks(cmd);
@@ -2166,8 +2168,9 @@ void transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
                 if (cmd->se_lun)
                         transport_lun_remove_cmd(cmd);
 
-                transport_put_cmd(cmd);
+                ret = transport_put_cmd(cmd);
         }
+        return ret;
 }
 EXPORT_SYMBOL(transport_generic_free_cmd);
 
@@ -2250,11 +2253,14 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
         unsigned long flags;
 
         spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
-
-        WARN_ON(se_sess->sess_tearing_down);
+        if (se_sess->sess_tearing_down) {
+                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                return;
+        }
         se_sess->sess_tearing_down = 1;
+        list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);
 
-        list_for_each_entry(se_cmd, &se_sess->sess_cmd_list, se_cmd_list)
+        list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list)
                 se_cmd->cmd_wait_set = 1;
 
         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
@@ -2263,44 +2269,32 @@ EXPORT_SYMBOL(target_sess_cmd_list_set_waiting);
 
 /* target_wait_for_sess_cmds - Wait for outstanding descriptors
  * @se_sess:    session to wait for active I/O
- * @wait_for_tasks:     Make extra transport_wait_for_tasks call
  */
-void target_wait_for_sess_cmds(
-        struct se_session *se_sess,
-        int wait_for_tasks)
+void target_wait_for_sess_cmds(struct se_session *se_sess)
 {
         struct se_cmd *se_cmd, *tmp_cmd;
-        bool rc = false;
+        unsigned long flags;
 
         list_for_each_entry_safe(se_cmd, tmp_cmd,
-                                &se_sess->sess_cmd_list, se_cmd_list) {
+                                &se_sess->sess_wait_list, se_cmd_list) {
                 list_del(&se_cmd->se_cmd_list);
 
                 pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
                         " %d\n", se_cmd, se_cmd->t_state,
                         se_cmd->se_tfo->get_cmd_state(se_cmd));
 
-                if (wait_for_tasks) {
-                        pr_debug("Calling transport_wait_for_tasks se_cmd: %p t_state: %d,"
-                                " fabric state: %d\n", se_cmd, se_cmd->t_state,
-                                se_cmd->se_tfo->get_cmd_state(se_cmd));
-
-                        rc = transport_wait_for_tasks(se_cmd);
-
-                        pr_debug("After transport_wait_for_tasks se_cmd: %p t_state: %d,"
-                                " fabric state: %d\n", se_cmd, se_cmd->t_state,
-                                se_cmd->se_tfo->get_cmd_state(se_cmd));
-                }
-
-                if (!rc) {
-                        wait_for_completion(&se_cmd->cmd_wait_comp);
-                        pr_debug("After cmd_wait_comp: se_cmd: %p t_state: %d"
-                                " fabric state: %d\n", se_cmd, se_cmd->t_state,
-                                se_cmd->se_tfo->get_cmd_state(se_cmd));
-                }
+                wait_for_completion(&se_cmd->cmd_wait_comp);
+                pr_debug("After cmd_wait_comp: se_cmd: %p t_state: %d"
+                        " fabric state: %d\n", se_cmd, se_cmd->t_state,
+                        se_cmd->se_tfo->get_cmd_state(se_cmd));
 
                 se_cmd->se_tfo->release_cmd(se_cmd);
         }
+
+        spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
+        WARN_ON(!list_empty(&se_sess->sess_cmd_list));
+        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
 }
 EXPORT_SYMBOL(target_wait_for_sess_cmds);