Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending

Pull SCSI target fixes from Nicholas Bellinger:
 "Here are the remaining fixes for v3.15.

  This series includes:

   - iser-target fix for ImmediateData exception reference count bug
     (Sagi + nab)
   - iscsi-target fix for MC/S login + potential iser-target MRDSL
     buffer overrun (Santosh + Roland)
   - iser-target fix for v3.15-rc multi network portal shutdown
     regression (nab)
   - target fix for allowing READ_CAPCITY during ALUA Standby access
     state (Chris + nab)
   - target fix for NULL pointer dereference of alua_access_state for
     un-configured devices (Chris + nab)"

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  target: Fix alua_access_state attribute OOPs for un-configured devices
  target: Allow READ_CAPACITY opcode in ALUA Standby access state
  iser-target: Fix multi network portal shutdown regression
  iscsi-target: Fix wrong buffer / buffer overrun in iscsi_change_param_value()
  iser-target: Add missing target_put_sess_cmd for ImmedateData failure

6 files changed, 50 insertions, 40 deletions

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index a1710465faaf..b9d647468b99 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -1210,6 +1210,8 @@ sequence_cmd:
 
         if (!rc && dump_payload == false && unsol_data)
                 iscsit_set_unsoliticed_dataout(cmd);
+        else if (dump_payload && imm_data)
+                target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
 
         return 0;
 }
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 46588c85d39b..9189bc0a87ae 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -460,6 +460,7 @@ int iscsit_del_np(struct iscsi_np *np)
         spin_lock_bh(&np->np_thread_lock);
         np->np_exports--;
         if (np->np_exports) {
+                np->enabled = true;
                 spin_unlock_bh(&np->np_thread_lock);
                 return 0;
         }
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index ca31fa1b8a4b..d9b1d88e1ad3 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -249,6 +249,28 @@ static void iscsi_login_set_conn_values(
         mutex_unlock(&auth_id_lock);
 }
 
+static __printf(2, 3) int iscsi_change_param_sprintf(
+        struct iscsi_conn *conn,
+        const char *fmt, ...)
+{
+        va_list args;
+        unsigned char buf[64];
+
+        memset(buf, 0, sizeof buf);
+
+        va_start(args, fmt);
+        vsnprintf(buf, sizeof buf, fmt, args);
+        va_end(args);
+
+        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
+                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                return -1;
+        }
+
+        return 0;
+}
+
 /*
  *      This is the leading connection of a new session,
  *      or session reinstatement.
@@ -339,7 +361,6 @@ static int iscsi_login_zero_tsih_s2(
 {
         struct iscsi_node_attrib *na;
         struct iscsi_session *sess = conn->sess;
-        unsigned char buf[32];
         bool iser = false;
 
         sess->tpg = conn->tpg;
@@ -380,26 +401,16 @@ static int iscsi_login_zero_tsih_s2(
          *
          * In our case, we have already located the struct iscsi_tiqn at this point.
          */
-        memset(buf, 0, 32);
-        sprintf(buf, "TargetPortalGroupTag=%hu", sess->tpg->tpgt);
-        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
+        if (iscsi_change_param_sprintf(conn, "TargetPortalGroupTag=%hu", sess->tpg->tpgt))
                 return -1;
-        }
 
         /*
          * Workaround for Initiators that have broken connection recovery logic.
          *
          * "We would really like to get rid of this." Linux-iSCSI.org team
          */
-        memset(buf, 0, 32);
-        sprintf(buf, "ErrorRecoveryLevel=%d", na->default_erl);
-        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
+        if (iscsi_change_param_sprintf(conn, "ErrorRecoveryLevel=%d", na->default_erl))
                 return -1;
-        }
 
         if (iscsi_login_disable_FIM_keys(conn->param_list, conn) < 0)
                 return -1;
@@ -411,12 +422,9 @@ static int iscsi_login_zero_tsih_s2(
                 unsigned long mrdsl, off;
                 int rc;
 
-                sprintf(buf, "RDMAExtensions=Yes");
-                if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-                        iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                if (iscsi_change_param_sprintf(conn, "RDMAExtensions=Yes"))
                         return -1;
-                }
+
                 /*
                  * Make MaxRecvDataSegmentLength PAGE_SIZE aligned for
                  * Immediate Data + Unsolicitied Data-OUT if necessary..
@@ -446,12 +454,8 @@ static int iscsi_login_zero_tsih_s2(
                 pr_warn("Aligning ISER MaxRecvDataSegmentLength: %lu down"
                         " to PAGE_SIZE\n", mrdsl);
 
-                sprintf(buf, "MaxRecvDataSegmentLength=%lu\n", mrdsl);
-                if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-                        iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                if (iscsi_change_param_sprintf(conn, "MaxRecvDataSegmentLength=%lu\n", mrdsl))
                         return -1;
-                }
                 /*
                  * ISER currently requires that ImmediateData + Unsolicited
                  * Data be disabled when protection / signature MRs are enabled.
@@ -461,19 +465,12 @@ check_prot:
                    (TARGET_PROT_DOUT_STRIP | TARGET_PROT_DOUT_PASS |
                     TARGET_PROT_DOUT_INSERT)) {
 
-                        sprintf(buf, "ImmediateData=No");
-                        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-                                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                                    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                        if (iscsi_change_param_sprintf(conn, "ImmediateData=No"))
                                 return -1;
-                        }
 
-                        sprintf(buf, "InitialR2T=Yes");
-                        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-                                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                                    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                        if (iscsi_change_param_sprintf(conn, "InitialR2T=Yes"))
                                 return -1;
-                        }
+
                         pr_debug("Forcing ImmediateData=No + InitialR2T=Yes for"
                                  " T10-PI enabled ISER session\n");
                 }
@@ -618,13 +615,8 @@ static int iscsi_login_non_zero_tsih_s2(
          *
          * In our case, we have already located the struct iscsi_tiqn at this point.
          */
-        memset(buf, 0, 32);
-        sprintf(buf, "TargetPortalGroupTag=%hu", sess->tpg->tpgt);
-        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
+        if (iscsi_change_param_sprintf(conn, "TargetPortalGroupTag=%hu", sess->tpg->tpgt))
                 return -1;
-        }
 
         return iscsi_login_disable_FIM_keys(conn->param_list, conn);
 }
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index ca1811858afd..1431e8400d28 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -184,7 +184,8 @@ static void iscsit_clear_tpg_np_login_thread(
                 return;
         }
 
-        tpg_np->tpg_np->enabled = false;
+        if (shutdown)
+                tpg_np->tpg_np->enabled = false;
         iscsit_reset_np_thread(tpg_np->tpg_np, tpg_np, tpg, shutdown);
 }
 
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index fcbe6125b73e..63512cc01a1f 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -576,7 +576,16 @@ static inline int core_alua_state_standby(
         case REPORT_LUNS:
         case RECEIVE_DIAGNOSTIC:
         case SEND_DIAGNOSTIC:
+        case READ_CAPACITY:
                 return 0;
+        case SERVICE_ACTION_IN:
+                switch (cdb[1] & 0x1f) {
+                case SAI_READ_CAPACITY_16:
+                        return 0;
+                default:
+                        set_ascq(cmd, ASCQ_04H_ALUA_TG_PT_STANDBY);
+                        return 1;
+                }
         case MAINTENANCE_IN:
                 switch (cdb[1] & 0x1f) {
                 case MI_REPORT_TARGET_PGS:
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 60a9ae6df763..bf55c5a04cfa 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -2227,6 +2227,11 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_access_state(
                         " tg_pt_gp ID: %hu\n", tg_pt_gp->tg_pt_gp_valid_id);
                 return -EINVAL;
         }
+        if (!(dev->dev_flags & DF_CONFIGURED)) {
+                pr_err("Unable to set alua_access_state while device is"
+                       " not configured\n");
+                return -ENODEV;
+        }
 
         ret = kstrtoul(page, 0, &tmp);
         if (ret < 0) {