iscsit: proper endianess conversions

Make sure all on the wire types are use as big endian and big endian only so
that sparse can verify all the conversions are done right.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

10 files changed, 122 insertions, 138 deletions

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 1c843b51f261..d6ce2182e672 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -785,9 +785,6 @@ static int iscsit_handle_scsi_cmd(
 
         hdr                     = (struct iscsi_scsi_req *) buf;
         payload_length          = ntoh24(hdr->dlength);
-        hdr->data_length        = be32_to_cpu(hdr->data_length);
-        hdr->cmdsn              = be32_to_cpu(hdr->cmdsn);
-        hdr->exp_statsn         = be32_to_cpu(hdr->exp_statsn);
 
         /* FIXME; Add checks for AdditionalHeaderSegment */
 
@@ -851,7 +848,7 @@ done:
                                 buf, conn);
         }
 
-        if ((hdr->data_length == payload_length) &&
+        if ((be32_to_cpu(hdr->data_length )== payload_length) &&
             (!(hdr->flags & ISCSI_FLAG_CMD_FINAL))) {
                 pr_err("Expected Data Transfer Length and Length of"
                         " Immediate Data are the same, but ISCSI_FLAG_CMD_FINAL"
@@ -860,7 +857,7 @@ done:
                                 buf, conn);
         }
 
-        if (payload_length > hdr->data_length) {
+        if (payload_length > be32_to_cpu(hdr->data_length)) {
                 pr_err("DataSegmentLength: %u is greater than"
                         " EDTL: %u, protocol error.\n", payload_length,
                                 hdr->data_length);
@@ -931,8 +928,8 @@ done:
                 spin_unlock_bh(&conn->sess->ttt_lock);
         } else if (hdr->flags & ISCSI_FLAG_CMD_WRITE)
                 cmd->targ_xfer_tag = 0xFFFFFFFF;
-        cmd->cmd_sn             = hdr->cmdsn;
-        cmd->exp_stat_sn        = hdr->exp_statsn;
+        cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
+        cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
         cmd->first_burst_len    = payload_length;
 
         if (cmd->data_direction == DMA_FROM_DEVICE) {
@@ -951,8 +948,9 @@ done:
          * Initialize struct se_cmd descriptor from target_core_mod infrastructure
          */
         transport_init_se_cmd(&cmd->se_cmd, &lio_target_fabric_configfs->tf_ops,
-                        conn->sess->se_sess, hdr->data_length, cmd->data_direction,
-                        sam_task_attr, cmd->sense_buffer + 2);
+                        conn->sess->se_sess, be32_to_cpu(hdr->data_length),
+                        cmd->data_direction, sam_task_attr,
+                        cmd->sense_buffer + 2);
 
         pr_debug("Got SCSI Command, ITT: 0x%08x, CmdSN: 0x%08x,"
                 " ExpXferLen: %u, Length: %u, CID: %hu\n", hdr->itt,
@@ -1027,7 +1025,7 @@ attach_cmd:
                                 1, 0, buf, cmd);
         }
 
-        iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
+        iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
 
         /*
          * If no Immediate Data is attached, it's OK to return now.
@@ -1193,10 +1191,6 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
 
         hdr                     = (struct iscsi_data *) buf;
         payload_length          = ntoh24(hdr->dlength);
-        hdr->ttt                = be32_to_cpu(hdr->ttt);
-        hdr->exp_statsn         = be32_to_cpu(hdr->exp_statsn);
-        hdr->datasn             = be32_to_cpu(hdr->datasn);
-        hdr->offset             = be32_to_cpu(hdr->offset);
 
         if (!payload_length) {
                 pr_err("DataOUT payload is ZERO, protocol error.\n");
@@ -1248,7 +1242,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
         se_cmd = &cmd->se_cmd;
         iscsit_mod_dataout_timer(cmd);
 
-        if ((hdr->offset + payload_length) > cmd->se_cmd.data_length) {
+        if ((be32_to_cpu(hdr->offset) + payload_length) > cmd->se_cmd.data_length) {
                 pr_err("DataOut Offset: %u, Length %u greater than"
                         " iSCSI Command EDTL %u, protocol error.\n",
                         hdr->offset, payload_length, cmd->se_cmd.data_length);
@@ -1331,7 +1325,8 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
         rx_size += payload_length;
         iov = &cmd->iov_data[0];
 
-        iov_ret = iscsit_map_iovec(cmd, iov, hdr->offset, payload_length);
+        iov_ret = iscsit_map_iovec(cmd, iov, be32_to_cpu(hdr->offset),
+                                   payload_length);
         if (iov_ret < 0)
                 return -1;
 
@@ -1362,7 +1357,8 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
                 u32 data_crc;
 
                 data_crc = iscsit_do_crypto_hash_sg(&conn->conn_rx_hash, cmd,
-                                                    hdr->offset, payload_length, padding,
+                                                    be32_to_cpu(hdr->offset),
+                                                    payload_length, padding,
                                                     cmd->pad_bytes);
 
                 if (checksum != data_crc) {
@@ -1423,9 +1419,6 @@ static int iscsit_handle_nop_out(
 
         hdr                     = (struct iscsi_nopout *) buf;
         payload_length          = ntoh24(hdr->dlength);
-        hdr->ttt                = be32_to_cpu(hdr->ttt);
-        hdr->cmdsn              = be32_to_cpu(hdr->cmdsn);
-        hdr->exp_statsn         = be32_to_cpu(hdr->exp_statsn);
 
         if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
                 pr_err("NOPOUT ITT is reserved, but Immediate Bit is"
@@ -1455,7 +1448,7 @@ static int iscsit_handle_nop_out(
          * Either way, make sure we allocate an struct iscsi_cmd, as both
          * can contain ping data.
          */
-        if (hdr->ttt == 0xFFFFFFFF) {
+        if (hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
                 cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
                 if (!cmd)
                         return iscsit_add_reject(
@@ -1468,12 +1461,12 @@ static int iscsit_handle_nop_out(
                                                 1 : 0);
                 conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt;
                 cmd->targ_xfer_tag      = 0xFFFFFFFF;
-                cmd->cmd_sn             = hdr->cmdsn;
-                cmd->exp_stat_sn        = hdr->exp_statsn;
+                cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
+                cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
                 cmd->data_direction     = DMA_NONE;
         }
 
-        if (payload_length && (hdr->ttt == 0xFFFFFFFF)) {
+        if (payload_length && hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
                 rx_size = payload_length;
                 ping_data = kzalloc(payload_length + 1, GFP_KERNEL);
                 if (!ping_data) {
@@ -1566,7 +1559,7 @@ static int iscsit_handle_nop_out(
                 list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
                 spin_unlock_bh(&conn->cmd_lock);
 
-                iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
+                iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
 
                 if (hdr->opcode & ISCSI_OP_IMMEDIATE) {
                         iscsit_add_cmd_to_response_queue(cmd, conn,
@@ -1587,11 +1580,11 @@ static int iscsit_handle_nop_out(
                 return 0;
         }
 
-        if (hdr->ttt != 0xFFFFFFFF) {
+        if (hdr->ttt != cpu_to_be32(0xFFFFFFFF)) {
                 /*
                  * This was a response to a unsolicited NOPIN ping.
                  */
-                cmd = iscsit_find_cmd_from_ttt(conn, hdr->ttt);
+                cmd = iscsit_find_cmd_from_ttt(conn, be32_to_cpu(hdr->ttt));
                 if (!cmd)
                         return -1;
 
@@ -1636,10 +1629,6 @@ static int iscsit_handle_task_mgt_cmd(
         u8 function;
 
         hdr                     = (struct iscsi_tm *) buf;
-        hdr->cmdsn              = be32_to_cpu(hdr->cmdsn);
-        hdr->exp_statsn         = be32_to_cpu(hdr->exp_statsn);
-        hdr->refcmdsn           = be32_to_cpu(hdr->refcmdsn);
-        hdr->exp_datasn         = be32_to_cpu(hdr->exp_datasn);
         hdr->flags &= ~ISCSI_FLAG_CMD_FINAL;
         function = hdr->flags;
 
@@ -1664,8 +1653,8 @@ static int iscsit_handle_task_mgt_cmd(
                                         buf, conn);
         }
         if ((function != ISCSI_TM_FUNC_ABORT_TASK) &&
-            (hdr->refcmdsn != ISCSI_RESERVED_TAG))
-                hdr->refcmdsn = ISCSI_RESERVED_TAG;
+            be32_to_cpu(hdr->refcmdsn) != ISCSI_RESERVED_TAG)
+                hdr->refcmdsn = cpu_to_be32(ISCSI_RESERVED_TAG);
 
         cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
         if (!cmd)
@@ -1742,8 +1731,8 @@ static int iscsit_handle_task_mgt_cmd(
         cmd->immediate_cmd      = ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
         cmd->init_task_tag      = hdr->itt;
         cmd->targ_xfer_tag      = 0xFFFFFFFF;
-        cmd->cmd_sn             = hdr->cmdsn;
-        cmd->exp_stat_sn        = hdr->exp_statsn;
+        cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
+        cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
         se_tmr                  = cmd->se_cmd.se_tmr_req;
         tmr_req                 = cmd->tmr_req;
         /*
@@ -1827,7 +1816,7 @@ attach:
                                         ISCSI_REASON_PROTOCOL_ERROR,
                                         1, 0, buf, cmd);
         }
-        iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
+        iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
 
         if (out_of_order_cmdsn || !(hdr->opcode & ISCSI_OP_IMMEDIATE))
                 return 0;
@@ -1864,9 +1853,6 @@ static int iscsit_handle_text_cmd(
 
         hdr                     = (struct iscsi_text *) buf;
         payload_length          = ntoh24(hdr->dlength);
-        hdr->ttt                = be32_to_cpu(hdr->ttt);
-        hdr->cmdsn              = be32_to_cpu(hdr->cmdsn);
-        hdr->exp_statsn         = be32_to_cpu(hdr->exp_statsn);
 
         if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
                 pr_err("Unable to accept text parameter length: %u"
@@ -1983,15 +1969,15 @@ static int iscsit_handle_text_cmd(
         cmd->immediate_cmd      = ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
         conn->sess->init_task_tag = cmd->init_task_tag  = hdr->itt;
         cmd->targ_xfer_tag      = 0xFFFFFFFF;
-        cmd->cmd_sn             = hdr->cmdsn;
-        cmd->exp_stat_sn        = hdr->exp_statsn;
+        cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
+        cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
         cmd->data_direction     = DMA_NONE;
 
         spin_lock_bh(&conn->cmd_lock);
         list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
         spin_unlock_bh(&conn->cmd_lock);
 
-        iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
+        iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
 
         if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
                 cmdsn_ret = iscsit_sequence_cmd(conn, cmd, hdr->cmdsn);
@@ -2125,9 +2111,6 @@ static int iscsit_handle_logout_cmd(
 
         hdr                     = (struct iscsi_logout *) buf;
         reason_code             = (hdr->flags & 0x7f);
-        hdr->cid                = be16_to_cpu(hdr->cid);
-        hdr->cmdsn              = be32_to_cpu(hdr->cmdsn);
-        hdr->exp_statsn = be32_to_cpu(hdr->exp_statsn);
 
         if (tiqn) {
                 spin_lock(&tiqn->logout_stats.lock);
@@ -2159,9 +2142,9 @@ static int iscsit_handle_logout_cmd(
         cmd->immediate_cmd      = ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
         conn->sess->init_task_tag = cmd->init_task_tag  = hdr->itt;
         cmd->targ_xfer_tag      = 0xFFFFFFFF;
-        cmd->cmd_sn             = hdr->cmdsn;
-        cmd->exp_stat_sn        = hdr->exp_statsn;
-        cmd->logout_cid         = hdr->cid;
+        cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
+        cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
+        cmd->logout_cid         = be16_to_cpu(hdr->cid);
         cmd->logout_reason      = reason_code;
         cmd->data_direction     = DMA_NONE;
 
@@ -2171,7 +2154,7 @@ static int iscsit_handle_logout_cmd(
          */
         if ((reason_code == ISCSI_LOGOUT_REASON_CLOSE_SESSION) ||
            ((reason_code == ISCSI_LOGOUT_REASON_CLOSE_CONNECTION) &&
-            (hdr->cid == conn->cid)))
+            be16_to_cpu(hdr->cid) == conn->cid))
                 logout_remove = 1;
 
         spin_lock_bh(&conn->cmd_lock);
@@ -2179,7 +2162,7 @@ static int iscsit_handle_logout_cmd(
         spin_unlock_bh(&conn->cmd_lock);
 
         if (reason_code != ISCSI_LOGOUT_REASON_RECOVERY)
-                iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
+                iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
 
         /*
          * Immediate commands are executed, well, immediately.
@@ -2212,10 +2195,6 @@ static int iscsit_handle_snack(
 
         hdr                     = (struct iscsi_snack *) buf;
         hdr->flags              &= ~ISCSI_FLAG_CMD_FINAL;
-        hdr->ttt                = be32_to_cpu(hdr->ttt);
-        hdr->exp_statsn         = be32_to_cpu(hdr->exp_statsn);
-        hdr->begrun             = be32_to_cpu(hdr->begrun);
-        hdr->runlength          = be32_to_cpu(hdr->runlength);
 
         pr_debug("Got ISCSI_INIT_SNACK, ITT: 0x%08x, ExpStatSN:"
                 " 0x%08x, Type: 0x%02x, BegRun: 0x%08x, RunLength: 0x%08x,"
@@ -2235,13 +2214,18 @@ static int iscsit_handle_snack(
         switch (hdr->flags & ISCSI_FLAG_SNACK_TYPE_MASK) {
         case 0:
                 return iscsit_handle_recovery_datain_or_r2t(conn, buf,
-                        hdr->itt, hdr->ttt, hdr->begrun, hdr->runlength);
+                        hdr->itt,
+                        be32_to_cpu(hdr->ttt),
+                        be32_to_cpu(hdr->begrun),
+                        be32_to_cpu(hdr->runlength));
         case ISCSI_FLAG_SNACK_TYPE_STATUS:
-                return iscsit_handle_status_snack(conn, hdr->itt, hdr->ttt,
-                        hdr->begrun, hdr->runlength);
+                return iscsit_handle_status_snack(conn, hdr->itt,
+                        be32_to_cpu(hdr->ttt),
+                        be32_to_cpu(hdr->begrun), be32_to_cpu(hdr->runlength));
         case ISCSI_FLAG_SNACK_TYPE_DATA_ACK:
-                return iscsit_handle_data_ack(conn, hdr->ttt, hdr->begrun,
-                        hdr->runlength);
+                return iscsit_handle_data_ack(conn, be32_to_cpu(hdr->ttt),
+                        be32_to_cpu(hdr->begrun),
+                        be32_to_cpu(hdr->runlength));
         case ISCSI_FLAG_SNACK_TYPE_RDATA:
                 /* FIXME: Support R-Data SNACK */
                 pr_err("R-Data SNACK Not Supported.\n");
@@ -2529,11 +2513,16 @@ static int iscsit_send_data_in(
                 put_unaligned_le64(0xFFFFFFFFFFFFFFFFULL, &hdr->lun);
 
         hdr->itt                = cmd->init_task_tag;
-        hdr->ttt                = (hdr->flags & ISCSI_FLAG_DATA_ACK) ?
-                                   cpu_to_be32(cmd->targ_xfer_tag) :
-                                   0xFFFFFFFF;
-        hdr->statsn             = (set_statsn) ? cpu_to_be32(cmd->stat_sn) :
-                                                0xFFFFFFFF;
+
+        if (hdr->flags & ISCSI_FLAG_DATA_ACK)
+                hdr->ttt                = cpu_to_be32(cmd->targ_xfer_tag);
+        else
+                hdr->ttt                = cpu_to_be32(0xFFFFFFFF);
+        if (set_statsn)
+                hdr->statsn             = cpu_to_be32(cmd->stat_sn);
+        else
+                hdr->statsn             = cpu_to_be32(0xFFFFFFFF);
+
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
         hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
         hdr->datasn             = cpu_to_be32(datain.data_sn);
@@ -3088,7 +3077,7 @@ static int iscsit_send_status(
                 cmd->se_cmd.scsi_sense_length += sizeof (__be16);
 
                 padding         = -(cmd->se_cmd.scsi_sense_length) & 3;
-                hton24(hdr->dlength, cmd->se_cmd.scsi_sense_length);
+                hton24(hdr->dlength, (u32)cmd->se_cmd.scsi_sense_length);
                 iov[iov_count].iov_base = cmd->sense_buffer;
                 iov[iov_count++].iov_len =
                                 (cmd->se_cmd.scsi_sense_length + padding);
@@ -3418,7 +3407,7 @@ static int iscsit_send_reject(
         hdr->opcode             = ISCSI_OP_REJECT;
         hdr->flags              |= ISCSI_FLAG_CMD_FINAL;
         hton24(hdr->dlength, ISCSI_HDR_LEN);
-        hdr->ffffffff           = 0xffffffff;
+        hdr->ffffffff           = cpu_to_be32(0xffffffff);
         cmd->stat_sn            = conn->stat_sn++;
         hdr->statsn             = cpu_to_be32(cmd->stat_sn);
         hdr->exp_cmdsn  = cpu_to_be32(conn->sess->exp_cmd_sn);
diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
index 226fe62d4e61..ff3f482968c8 100644
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -479,7 +479,6 @@ struct iscsi_cmd {
 
 struct iscsi_tmr_req {
         bool                    task_reassign:1;
-        u32                     ref_cmd_sn;
         u32                     exp_data_sn;
         struct iscsi_cmd        *ref_cmd;
         struct iscsi_conn_recovery *conn_recovery;
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 0c37533ccbb5..8aacf611b86d 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -95,14 +95,15 @@ static int iscsit_dataout_within_command_recovery_check(
          */
         if (conn->sess->sess_ops->DataSequenceInOrder) {
                 if ((cmd->cmd_flags & ICF_WITHIN_COMMAND_RECOVERY) &&
-                    (cmd->write_data_done != hdr->offset))
+                    cmd->write_data_done != be32_to_cpu(hdr->offset))
                         goto dump;
 
                 cmd->cmd_flags &= ~ICF_WITHIN_COMMAND_RECOVERY;
         } else {
                 struct iscsi_seq *seq;
 
-                seq = iscsit_get_seq_holder(cmd, hdr->offset, payload_length);
+                seq = iscsit_get_seq_holder(cmd, be32_to_cpu(hdr->offset),
+                                            payload_length);
                 if (!seq)
                         return DATAOUT_CANNOT_RECOVER;
                 /*
@@ -111,15 +112,15 @@ static int iscsit_dataout_within_command_recovery_check(
                 cmd->seq_ptr = seq;
 
                 if (conn->sess->sess_ops->DataPDUInOrder) {
-                        if ((seq->status ==
-                             DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY) &&
-                           ((seq->offset != hdr->offset) ||
-                            (seq->data_sn != hdr->datasn)))
+                        if (seq->status ==
+                            DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY &&
+                           (seq->offset != be32_to_cpu(hdr->offset) ||
+                            seq->data_sn != be32_to_cpu(hdr->datasn)))
                                 goto dump;
                 } else {
-                        if ((seq->status ==
-                             DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY) &&
-                            (seq->data_sn != hdr->datasn))
+                        if (seq->status ==
+                             DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY &&
+                            seq->data_sn != be32_to_cpu(hdr->datasn))
                                 goto dump;
                 }
 
@@ -148,12 +149,12 @@ static int iscsit_dataout_check_unsolicited_sequence(
         u32 payload_length = ntoh24(hdr->dlength);
 
 
-        if ((hdr->offset < cmd->seq_start_offset) ||
-           ((hdr->offset + payload_length) > cmd->seq_end_offset)) {
+        if ((be32_to_cpu(hdr->offset) < cmd->seq_start_offset) ||
+           ((be32_to_cpu(hdr->offset) + payload_length) > cmd->seq_end_offset)) {
                 pr_err("Command ITT: 0x%08x with Offset: %u,"
                 " Length: %u outside of Unsolicited Sequence %u:%u while"
                 " DataSequenceInOrder=Yes.\n", cmd->init_task_tag,
-                hdr->offset, payload_length, cmd->seq_start_offset,
+                be32_to_cpu(hdr->offset), payload_length, cmd->seq_start_offset,
                         cmd->seq_end_offset);
                 return DATAOUT_CANNOT_RECOVER;
         }
@@ -236,12 +237,12 @@ static int iscsit_dataout_check_sequence(
                  * fullfilling an Recovery R2T, it's best to just dump the
                  * payload here, instead of erroring out.
                  */
-                if ((hdr->offset < cmd->seq_start_offset) ||
-                   ((hdr->offset + payload_length) > cmd->seq_end_offset)) {
+                if ((be32_to_cpu(hdr->offset) < cmd->seq_start_offset) ||
+                   ((be32_to_cpu(hdr->offset) + payload_length) > cmd->seq_end_offset)) {
                         pr_err("Command ITT: 0x%08x with Offset: %u,"
                         " Length: %u outside of Sequence %u:%u while"
                         " DataSequenceInOrder=Yes.\n", cmd->init_task_tag,
-                        hdr->offset, payload_length, cmd->seq_start_offset,
+                        be32_to_cpu(hdr->offset), payload_length, cmd->seq_start_offset,
                                 cmd->seq_end_offset);
 
                         if (iscsit_dump_data_payload(conn, payload_length, 1) < 0)
@@ -251,7 +252,8 @@ static int iscsit_dataout_check_sequence(
 
                 next_burst_len = (cmd->next_burst_len + payload_length);
         } else {
-                seq = iscsit_get_seq_holder(cmd, hdr->offset, payload_length);
+                seq = iscsit_get_seq_holder(cmd, be32_to_cpu(hdr->offset),
+                                            payload_length);
                 if (!seq)
                         return DATAOUT_CANNOT_RECOVER;
                 /*
@@ -366,16 +368,16 @@ static int iscsit_dataout_check_datasn(
                 data_sn = seq->data_sn;
         }
 
-        if (hdr->datasn > data_sn) {
+        if (be32_to_cpu(hdr->datasn) > data_sn) {
                 pr_err("Command ITT: 0x%08x, received DataSN: 0x%08x"
                         " higher than expected 0x%08x.\n", cmd->init_task_tag,
-                                hdr->datasn, data_sn);
+                                be32_to_cpu(hdr->datasn), data_sn);
                 recovery = 1;
                 goto recover;
-        } else if (hdr->datasn < data_sn) {
+        } else if (be32_to_cpu(hdr->datasn) < data_sn) {
                 pr_err("Command ITT: 0x%08x, received DataSN: 0x%08x"
                         " lower than expected 0x%08x, discarding payload.\n",
-                        cmd->init_task_tag, hdr->datasn, data_sn);
+                        cmd->init_task_tag, be32_to_cpu(hdr->datasn), data_sn);
                 dump = 1;
                 goto dump;
         }
@@ -415,26 +417,27 @@ static int iscsit_dataout_pre_datapduinorder_yes(
          * error has occured and fail the connection.
          */
         if (conn->sess->sess_ops->DataSequenceInOrder) {
-                if (hdr->offset != cmd->write_data_done) {
+                if (be32_to_cpu(hdr->offset) != cmd->write_data_done) {
                         pr_err("Command ITT: 0x%08x, received offset"
                         " %u different than expected %u.\n", cmd->init_task_tag,
-                                hdr->offset, cmd->write_data_done);
+                                be32_to_cpu(hdr->offset), cmd->write_data_done);
                         recovery = 1;
                         goto recover;
                 }
         } else {
                 struct iscsi_seq *seq = cmd->seq_ptr;
 
-                if (hdr->offset > seq->offset) {
+                if (be32_to_cpu(hdr->offset) > seq->offset) {
                         pr_err("Command ITT: 0x%08x, received offset"
                         " %u greater than expected %u.\n", cmd->init_task_tag,
-                                hdr->offset, seq->offset);
+                                be32_to_cpu(hdr->offset), seq->offset);
                         recovery = 1;
                         goto recover;
-                } else if (hdr->offset < seq->offset) {
+                } else if (be32_to_cpu(hdr->offset) < seq->offset) {
                         pr_err("Command ITT: 0x%08x, received offset"
                         " %u less than expected %u, discarding payload.\n",
-                                cmd->init_task_tag, hdr->offset, seq->offset);
+                                cmd->init_task_tag, be32_to_cpu(hdr->offset),
+                                seq->offset);
                         dump = 1;
                         goto dump;
                 }
@@ -453,7 +456,7 @@ dump:
                 return DATAOUT_CANNOT_RECOVER;
 
         return (recovery) ? iscsit_recover_dataout_sequence(cmd,
-                hdr->offset, payload_length) :
+                be32_to_cpu(hdr->offset), payload_length) :
                (dump) ? DATAOUT_WITHIN_COMMAND_RECOVERY : DATAOUT_NORMAL;
 }
 
@@ -465,7 +468,8 @@ static int iscsit_dataout_pre_datapduinorder_no(
         struct iscsi_data *hdr = (struct iscsi_data *) buf;
         u32 payload_length = ntoh24(hdr->dlength);
 
-        pdu = iscsit_get_pdu_holder(cmd, hdr->offset, payload_length);
+        pdu = iscsit_get_pdu_holder(cmd, be32_to_cpu(hdr->offset),
+                                    payload_length);
         if (!pdu)
                 return DATAOUT_CANNOT_RECOVER;
 
@@ -479,7 +483,7 @@ static int iscsit_dataout_pre_datapduinorder_no(
         case ISCSI_PDU_RECEIVED_OK:
                 pr_err("Command ITT: 0x%08x received already gotten"
                         " Offset: %u, Length: %u\n", cmd->init_task_tag,
-                                hdr->offset, payload_length);
+                                be32_to_cpu(hdr->offset), payload_length);
                 return iscsit_dump_data_payload(cmd->conn, payload_length, 1);
         default:
                 return DATAOUT_CANNOT_RECOVER;
@@ -553,7 +557,7 @@ static int iscsit_dataout_post_crc_passed(
         if (cmd->unsolicited_data) {
                 if ((cmd->first_burst_len + payload_length) ==
                      conn->sess->sess_ops->FirstBurstLength) {
-                        if (iscsit_dataout_update_r2t(cmd, hdr->offset,
+                        if (iscsit_dataout_update_r2t(cmd, be32_to_cpu(hdr->offset),
                                         payload_length) < 0)
                                 return DATAOUT_CANNOT_RECOVER;
                         send_r2t = 1;
@@ -561,7 +565,8 @@ static int iscsit_dataout_post_crc_passed(
 
                 if (!conn->sess->sess_ops->DataPDUInOrder) {
                         ret = iscsit_dataout_update_datapduinorder_no(cmd,
-                                hdr->datasn, (hdr->flags & ISCSI_FLAG_CMD_FINAL));
+                                be32_to_cpu(hdr->datasn),
+                                (hdr->flags & ISCSI_FLAG_CMD_FINAL));
                         if (ret == DATAOUT_CANNOT_RECOVER)
                                 return ret;
                 }
@@ -586,7 +591,8 @@ static int iscsit_dataout_post_crc_passed(
                 if (conn->sess->sess_ops->DataSequenceInOrder) {
                         if ((cmd->next_burst_len + payload_length) ==
                              conn->sess->sess_ops->MaxBurstLength) {
-                                if (iscsit_dataout_update_r2t(cmd, hdr->offset,
+                                if (iscsit_dataout_update_r2t(cmd,
+                                                be32_to_cpu(hdr->offset),
                                                 payload_length) < 0)
                                         return DATAOUT_CANNOT_RECOVER;
                                 send_r2t = 1;
@@ -594,7 +600,7 @@ static int iscsit_dataout_post_crc_passed(
 
                         if (!conn->sess->sess_ops->DataPDUInOrder) {
                                 ret = iscsit_dataout_update_datapduinorder_no(
-                                                cmd, hdr->datasn,
+                                                cmd, be32_to_cpu(hdr->datasn),
                                                 (hdr->flags & ISCSI_FLAG_CMD_FINAL));
                                 if (ret == DATAOUT_CANNOT_RECOVER)
                                         return ret;
@@ -610,7 +616,8 @@ static int iscsit_dataout_post_crc_passed(
 
                         if ((seq->next_burst_len + payload_length) ==
                              seq->xfer_len) {
-                                if (iscsit_dataout_update_r2t(cmd, hdr->offset,
+                                if (iscsit_dataout_update_r2t(cmd,
+                                                be32_to_cpu(hdr->offset),
                                                 payload_length) < 0)
                                         return DATAOUT_CANNOT_RECOVER;
                                 send_r2t = 1;
@@ -618,7 +625,7 @@ static int iscsit_dataout_post_crc_passed(
 
                         if (!conn->sess->sess_ops->DataPDUInOrder) {
                                 ret = iscsit_dataout_update_datapduinorder_no(
-                                                cmd, hdr->datasn,
+                                                cmd, be32_to_cpu(hdr->datasn),
                                                 (hdr->flags & ISCSI_FLAG_CMD_FINAL));
                                 if (ret == DATAOUT_CANNOT_RECOVER)
                                         return ret;
@@ -678,7 +685,8 @@ static int iscsit_dataout_post_crc_failed(
         }
 
 recover:
-        return iscsit_recover_dataout_sequence(cmd, hdr->offset, payload_length);
+        return iscsit_recover_dataout_sequence(cmd, be32_to_cpu(hdr->offset),
+                                                payload_length);
 }
 
 /*
diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
index 660694544128..17d8c20094fd 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.c
+++ b/drivers/target/iscsi/iscsi_target_erl2.c
@@ -36,7 +36,7 @@
  */
 void iscsit_create_conn_recovery_datain_values(
         struct iscsi_cmd *cmd,
-        u32 exp_data_sn)
+        __be32 exp_data_sn)
 {
         u32 data_sn = 0;
         struct iscsi_conn *conn = cmd->conn;
@@ -44,7 +44,7 @@ void iscsit_create_conn_recovery_datain_values(
         cmd->next_burst_len = 0;
         cmd->read_data_done = 0;
 
-        while (exp_data_sn > data_sn) {
+        while (be32_to_cpu(exp_data_sn) > data_sn) {
                 if ((cmd->next_burst_len +
                      conn->conn_ops->MaxRecvDataSegmentLength) <
                      conn->sess->sess_ops->MaxBurstLength) {
diff --git a/drivers/target/iscsi/iscsi_target_erl2.h b/drivers/target/iscsi/iscsi_target_erl2.h
index 22f8d24780a6..63f2501f3fe0 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.h
+++ b/drivers/target/iscsi/iscsi_target_erl2.h
@@ -1,7 +1,7 @@
 #ifndef ISCSI_TARGET_ERL2_H
 #define ISCSI_TARGET_ERL2_H
 
-extern void iscsit_create_conn_recovery_datain_values(struct iscsi_cmd *, u32);
+extern void iscsit_create_conn_recovery_datain_values(struct iscsi_cmd *, __be32);
 extern void iscsit_create_conn_recovery_dataout_values(struct iscsi_cmd *);
 extern struct iscsi_conn_recovery *iscsit_get_inactive_connection_recovery_entry(
                         struct iscsi_session *, u16);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 4c83d7a39bf3..cdc8a10939c3 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -192,10 +192,10 @@ int iscsi_check_for_session_reinstatement(struct iscsi_conn *conn)
 static void iscsi_login_set_conn_values(
         struct iscsi_session *sess,
         struct iscsi_conn *conn,
-        u16 cid)
+        __be16 cid)
 {
         conn->sess              = sess;
-        conn->cid               = cid;
+        conn->cid               = be16_to_cpu(cid);
         /*
          * Generate a random Status sequence number (statsn) for the new
          * iSCSI connection.
@@ -230,7 +230,7 @@ static int iscsi_login_zero_tsih_s1(
         iscsi_login_set_conn_values(sess, conn, pdu->cid);
         sess->init_task_tag     = pdu->itt;
         memcpy(&sess->isid, pdu->isid, 6);
-        sess->exp_cmd_sn        = pdu->cmdsn;
+        sess->exp_cmd_sn        = be32_to_cpu(pdu->cmdsn);
         INIT_LIST_HEAD(&sess->sess_conn_list);
         INIT_LIST_HEAD(&sess->sess_ooo_cmdsn_list);
         INIT_LIST_HEAD(&sess->cr_active_list);
@@ -271,7 +271,7 @@ static int iscsi_login_zero_tsih_s1(
          * The FFP CmdSN window values will be allocated from the TPG's
          * Initiator Node's ACL once the login has been successfully completed.
          */
-        sess->max_cmd_sn        = pdu->cmdsn;
+        sess->max_cmd_sn        = be32_to_cpu(pdu->cmdsn);
 
         sess->sess_ops = kzalloc(sizeof(struct iscsi_sess_ops), GFP_KERNEL);
         if (!sess->sess_ops) {
@@ -449,7 +449,7 @@ static int iscsi_login_non_zero_tsih_s2(
                    (sess_p->time2retain_timer_flags & ISCSI_TF_EXPIRED))
                         continue;
                 if (!memcmp(sess_p->isid, pdu->isid, 6) &&
-                     (sess_p->tsih == pdu->tsih)) {
+                     (sess_p->tsih == be16_to_cpu(pdu->tsih))) {
                         iscsit_inc_session_usage_count(sess_p);
                         iscsit_stop_time2retain_timer(sess_p);
                         sess = sess_p;
@@ -951,10 +951,6 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         }
 
         pdu                     = (struct iscsi_login_req *) buffer;
-        pdu->cid                = be16_to_cpu(pdu->cid);
-        pdu->tsih               = be16_to_cpu(pdu->tsih);
-        pdu->cmdsn              = be32_to_cpu(pdu->cmdsn);
-        pdu->exp_statsn         = be32_to_cpu(pdu->exp_statsn);
 
         /*
          * Used by iscsit_tx_login_rsp() for Login Resonses PDUs
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 33ed9b5209cd..e9053a04f24c 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -360,11 +360,9 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
                 return -1;
 
         login->rsp_length               = 0;
-        login_rsp->tsih                 = be16_to_cpu(login_rsp->tsih);
-        login_rsp->statsn               = be32_to_cpu(login_rsp->statsn);
         mutex_lock(&sess->cmdsn_mutex);
-        login_rsp->exp_cmdsn            = be32_to_cpu(sess->exp_cmd_sn);
-        login_rsp->max_cmdsn            = be32_to_cpu(sess->max_cmd_sn);
+        login_rsp->exp_cmdsn            = cpu_to_be32(sess->exp_cmd_sn);
+        login_rsp->max_cmdsn            = cpu_to_be32(sess->max_cmd_sn);
         mutex_unlock(&sess->cmdsn_mutex);
 
         return 0;
@@ -380,10 +378,6 @@ static int iscsi_target_do_rx_login_io(struct iscsi_conn *conn, struct iscsi_log
 
         login_req = (struct iscsi_login_req *) login->req;
         payload_length                  = ntoh24(login_req->dlength);
-        login_req->tsih                 = be16_to_cpu(login_req->tsih);
-        login_req->cid                  = be16_to_cpu(login_req->cid);
-        login_req->cmdsn                = be32_to_cpu(login_req->cmdsn);
-        login_req->exp_statsn           = be32_to_cpu(login_req->exp_statsn);
 
         pr_debug("Got Login Command, Flags 0x%02x, ITT: 0x%08x,"
                 " CmdSN: 0x%08x, ExpStatSN: 0x%08x, CID: %hu, Length: %u\n",
@@ -760,11 +754,11 @@ static int iscsi_target_locate_portal(
         login->version_min      = login_req->min_version;
         login->version_max      = login_req->max_version;
         memcpy(login->isid, login_req->isid, 6);
-        login->cmd_sn           = login_req->cmdsn;
+        login->cmd_sn           = be32_to_cpu(login_req->cmdsn);
         login->init_task_tag    = login_req->itt;
-        login->initial_exp_statsn = login_req->exp_statsn;
-        login->cid              = login_req->cid;
-        login->tsih             = login_req->tsih;
+        login->initial_exp_statsn = be32_to_cpu(login_req->exp_statsn);
+        login->cid              = be16_to_cpu(login_req->cid);
+        login->tsih             = be16_to_cpu(login_req->tsih);
 
         if (iscsi_target_get_initial_payload(conn, login) < 0)
                 return -1;
diff --git a/drivers/target/iscsi/iscsi_target_tmr.c b/drivers/target/iscsi/iscsi_target_tmr.c
index 925f829a3704..4a99820d063b 100644
--- a/drivers/target/iscsi/iscsi_target_tmr.c
+++ b/drivers/target/iscsi/iscsi_target_tmr.c
@@ -50,11 +50,11 @@ u8 iscsit_tmr_abort_task(
         if (!ref_cmd) {
                 pr_err("Unable to locate RefTaskTag: 0x%08x on CID:"
                         " %hu.\n", hdr->rtt, conn->cid);
-                return ((hdr->refcmdsn >= conn->sess->exp_cmd_sn) &&
-                        (hdr->refcmdsn <= conn->sess->max_cmd_sn)) ?
+                return (be32_to_cpu(hdr->refcmdsn) >= conn->sess->exp_cmd_sn &&
+                        be32_to_cpu(hdr->refcmdsn) <= conn->sess->max_cmd_sn) ?
                         ISCSI_TMF_RSP_COMPLETE : ISCSI_TMF_RSP_NO_TASK;
         }
-        if (ref_cmd->cmd_sn != hdr->refcmdsn) {
+        if (ref_cmd->cmd_sn != be32_to_cpu(hdr->refcmdsn)) {
                 pr_err("RefCmdSN 0x%08x does not equal"
                         " task's CmdSN 0x%08x. Rejecting ABORT_TASK.\n",
                         hdr->refcmdsn, ref_cmd->cmd_sn);
@@ -63,8 +63,7 @@ u8 iscsit_tmr_abort_task(
 
         se_tmr->ref_task_tag            = (__force u32)hdr->rtt;
         tmr_req->ref_cmd                = ref_cmd;
-        tmr_req->ref_cmd_sn             = hdr->refcmdsn;
-        tmr_req->exp_data_sn            = hdr->exp_datasn;
+        tmr_req->exp_data_sn            = be32_to_cpu(hdr->exp_datasn);
 
         return ISCSI_TMF_RSP_COMPLETE;
 }
@@ -173,8 +172,7 @@ u8 iscsit_tmr_task_reassign(
 
         se_tmr->ref_task_tag            = (__force u32)hdr->rtt;
         tmr_req->ref_cmd                = ref_cmd;
-        tmr_req->ref_cmd_sn             = hdr->refcmdsn;
-        tmr_req->exp_data_sn            = hdr->exp_datasn;
+        tmr_req->exp_data_sn            = be32_to_cpu(hdr->exp_datasn);
         tmr_req->conn_recovery          = cr;
         tmr_req->task_reassign          = 1;
         /*
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 22bec9e899c0..afd98ccd40ae 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -274,14 +274,14 @@ static inline int iscsit_check_received_cmdsn(struct iscsi_session *sess, u32 cm
 int iscsit_sequence_cmd(
         struct iscsi_conn *conn,
         struct iscsi_cmd *cmd,
-        u32 cmdsn)
+        __be32 cmdsn)
 {
         int ret;
         int cmdsn_ret;
 
         mutex_lock(&conn->sess->cmdsn_mutex);
 
-        cmdsn_ret = iscsit_check_received_cmdsn(conn->sess, cmdsn);
+        cmdsn_ret = iscsit_check_received_cmdsn(conn->sess, be32_to_cpu(cmdsn));
         switch (cmdsn_ret) {
         case CMDSN_NORMAL_OPERATION:
                 ret = iscsit_execute_cmd(cmd, 0);
@@ -289,7 +289,7 @@ int iscsit_sequence_cmd(
                         iscsit_execute_ooo_cmdsns(conn->sess);
                 break;
         case CMDSN_HIGHER_THAN_EXP:
-                ret = iscsit_handle_ooo_cmdsn(conn->sess, cmd, cmdsn);
+                ret = iscsit_handle_ooo_cmdsn(conn->sess, cmd, be32_to_cpu(cmdsn));
                 break;
         case CMDSN_LOWER_THAN_EXP:
                 cmd->i_state = ISTATE_REMOVE;
diff --git a/drivers/target/iscsi/iscsi_target_util.h b/drivers/target/iscsi/iscsi_target_util.h
index 09e2f9f563a7..44054bd35437 100644
--- a/drivers/target/iscsi/iscsi_target_util.h
+++ b/drivers/target/iscsi/iscsi_target_util.h
@@ -12,7 +12,7 @@ extern struct iscsi_cmd *iscsit_allocate_cmd(struct iscsi_conn *, gfp_t);
 extern struct iscsi_seq *iscsit_get_seq_holder_for_datain(struct iscsi_cmd *, u32);
 extern struct iscsi_seq *iscsit_get_seq_holder_for_r2t(struct iscsi_cmd *);
 extern struct iscsi_r2t *iscsit_get_holder_for_r2tsn(struct iscsi_cmd *, u32);
-int iscsit_sequence_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, u32 cmdsn);
+int iscsit_sequence_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, __be32 cmdsn);
 extern int iscsit_check_unsolicited_dataout(struct iscsi_cmd *, unsigned char *);
 extern struct iscsi_cmd *iscsit_find_cmd_from_itt(struct iscsi_conn *, itt_t);
 extern struct iscsi_cmd *iscsit_find_cmd_from_itt_or_dump(struct iscsi_conn *,