diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2014-02-15 19:18:47 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-02-15 19:18:47 -0500 |
commit | 946dd683afb611721cce2cc7e76a19e74f58e067 (patch) | |
tree | f27e415c00548c56c2d6f35013e43b1df5576018 | |
parent | 2d0ef4fb34b0462d84a2d87292144b9dad79c8d0 (diff) | |
parent | d6a65fdc8903e632aa7bf86ee0f61a73969371f6 (diff) |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull SCSI target fixes from Nicholas Bellinger:
"Mostly minor fixes this time to v3.14-rc1 related changes. Also
included is one fix for a free after use regression in persistent
reservations UNREGISTER logic that is CC'ed to >= v3.11.y stable"
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
Target/sbc: Fix protection copy routine
IB/srpt: replace strict_strtoul() with kstrtoul()
target: Simplify command completion by removing CMD_T_FAILED flag
iser-target: Fix leak on failure in isert_conn_create_fastreg_pool
iscsi-target: Fix SNACK Type 1 + BegRun=0 handling
target: Fix missing length check in spc_emulate_evpd_83()
qla2xxx: Remove last vestiges of qla_tgt_cmd.cmd_list
target: Fix 32-bit + CONFIG_LBDAF=n link error w/ sector_div
target: Fix free-after-use regression in PR unregister
-rw-r--r-- | drivers/infiniband/ulp/isert/ib_isert.c | 1 | ||||
-rw-r--r-- | drivers/infiniband/ulp/srpt/ib_srpt.c | 14 | ||||
-rw-r--r-- | drivers/scsi/qla2xxx/qla_target.c | 2 | ||||
-rw-r--r-- | drivers/scsi/qla2xxx/qla_target.h | 1 | ||||
-rw-r--r-- | drivers/target/iscsi/iscsi_target_erl1.c | 4 | ||||
-rw-r--r-- | drivers/target/target_core_alua.c | 2 | ||||
-rw-r--r-- | drivers/target/target_core_pr.c | 11 | ||||
-rw-r--r-- | drivers/target/target_core_sbc.c | 8 | ||||
-rw-r--r-- | drivers/target/target_core_spc.c | 4 | ||||
-rw-r--r-- | drivers/target/target_core_transport.c | 5 | ||||
-rw-r--r-- | include/target/target_core_base.h | 1 |
11 files changed, 30 insertions, 23 deletions
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index 2b161be3c1a3..d18d08a076e8 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c | |||
@@ -453,6 +453,7 @@ isert_conn_create_fastreg_pool(struct isert_conn *isert_conn) | |||
453 | if (ret) { | 453 | if (ret) { |
454 | pr_err("Failed to create fastreg descriptor err=%d\n", | 454 | pr_err("Failed to create fastreg descriptor err=%d\n", |
455 | ret); | 455 | ret); |
456 | kfree(fr_desc); | ||
456 | goto err; | 457 | goto err; |
457 | } | 458 | } |
458 | 459 | ||
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index 520a7e5a490b..0e537d8d0e47 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c | |||
@@ -3666,9 +3666,9 @@ static ssize_t srpt_tpg_attrib_store_srp_max_rdma_size( | |||
3666 | unsigned long val; | 3666 | unsigned long val; |
3667 | int ret; | 3667 | int ret; |
3668 | 3668 | ||
3669 | ret = strict_strtoul(page, 0, &val); | 3669 | ret = kstrtoul(page, 0, &val); |
3670 | if (ret < 0) { | 3670 | if (ret < 0) { |
3671 | pr_err("strict_strtoul() failed with ret: %d\n", ret); | 3671 | pr_err("kstrtoul() failed with ret: %d\n", ret); |
3672 | return -EINVAL; | 3672 | return -EINVAL; |
3673 | } | 3673 | } |
3674 | if (val > MAX_SRPT_RDMA_SIZE) { | 3674 | if (val > MAX_SRPT_RDMA_SIZE) { |
@@ -3706,9 +3706,9 @@ static ssize_t srpt_tpg_attrib_store_srp_max_rsp_size( | |||
3706 | unsigned long val; | 3706 | unsigned long val; |
3707 | int ret; | 3707 | int ret; |
3708 | 3708 | ||
3709 | ret = strict_strtoul(page, 0, &val); | 3709 | ret = kstrtoul(page, 0, &val); |
3710 | if (ret < 0) { | 3710 | if (ret < 0) { |
3711 | pr_err("strict_strtoul() failed with ret: %d\n", ret); | 3711 | pr_err("kstrtoul() failed with ret: %d\n", ret); |
3712 | return -EINVAL; | 3712 | return -EINVAL; |
3713 | } | 3713 | } |
3714 | if (val > MAX_SRPT_RSP_SIZE) { | 3714 | if (val > MAX_SRPT_RSP_SIZE) { |
@@ -3746,9 +3746,9 @@ static ssize_t srpt_tpg_attrib_store_srp_sq_size( | |||
3746 | unsigned long val; | 3746 | unsigned long val; |
3747 | int ret; | 3747 | int ret; |
3748 | 3748 | ||
3749 | ret = strict_strtoul(page, 0, &val); | 3749 | ret = kstrtoul(page, 0, &val); |
3750 | if (ret < 0) { | 3750 | if (ret < 0) { |
3751 | pr_err("strict_strtoul() failed with ret: %d\n", ret); | 3751 | pr_err("kstrtoul() failed with ret: %d\n", ret); |
3752 | return -EINVAL; | 3752 | return -EINVAL; |
3753 | } | 3753 | } |
3754 | if (val > MAX_SRPT_SRQ_SIZE) { | 3754 | if (val > MAX_SRPT_SRQ_SIZE) { |
@@ -3793,7 +3793,7 @@ static ssize_t srpt_tpg_store_enable( | |||
3793 | unsigned long tmp; | 3793 | unsigned long tmp; |
3794 | int ret; | 3794 | int ret; |
3795 | 3795 | ||
3796 | ret = strict_strtoul(page, 0, &tmp); | 3796 | ret = kstrtoul(page, 0, &tmp); |
3797 | if (ret < 0) { | 3797 | if (ret < 0) { |
3798 | printk(KERN_ERR "Unable to extract srpt_tpg_store_enable\n"); | 3798 | printk(KERN_ERR "Unable to extract srpt_tpg_store_enable\n"); |
3799 | return -EINVAL; | 3799 | return -EINVAL; |
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c index 9e80d61e5a3a..2eb97d7e8d12 100644 --- a/drivers/scsi/qla2xxx/qla_target.c +++ b/drivers/scsi/qla2xxx/qla_target.c | |||
@@ -2595,8 +2595,6 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha, | |||
2595 | return -ENOMEM; | 2595 | return -ENOMEM; |
2596 | } | 2596 | } |
2597 | 2597 | ||
2598 | INIT_LIST_HEAD(&cmd->cmd_list); | ||
2599 | |||
2600 | memcpy(&cmd->atio, atio, sizeof(*atio)); | 2598 | memcpy(&cmd->atio, atio, sizeof(*atio)); |
2601 | cmd->state = QLA_TGT_STATE_NEW; | 2599 | cmd->state = QLA_TGT_STATE_NEW; |
2602 | cmd->tgt = vha->vha_tgt.qla_tgt; | 2600 | cmd->tgt = vha->vha_tgt.qla_tgt; |
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h index 1d10eecad499..66e755cdde57 100644 --- a/drivers/scsi/qla2xxx/qla_target.h +++ b/drivers/scsi/qla2xxx/qla_target.h | |||
@@ -855,7 +855,6 @@ struct qla_tgt_cmd { | |||
855 | uint16_t loop_id; /* to save extra sess dereferences */ | 855 | uint16_t loop_id; /* to save extra sess dereferences */ |
856 | struct qla_tgt *tgt; /* to save extra sess dereferences */ | 856 | struct qla_tgt *tgt; /* to save extra sess dereferences */ |
857 | struct scsi_qla_host *vha; | 857 | struct scsi_qla_host *vha; |
858 | struct list_head cmd_list; | ||
859 | 858 | ||
860 | struct atio_from_isp atio; | 859 | struct atio_from_isp atio; |
861 | }; | 860 | }; |
diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c index e048d6439f4a..cda4d80cfaef 100644 --- a/drivers/target/iscsi/iscsi_target_erl1.c +++ b/drivers/target/iscsi/iscsi_target_erl1.c | |||
@@ -507,7 +507,9 @@ int iscsit_handle_status_snack( | |||
507 | u32 last_statsn; | 507 | u32 last_statsn; |
508 | int found_cmd; | 508 | int found_cmd; |
509 | 509 | ||
510 | if (conn->exp_statsn > begrun) { | 510 | if (!begrun) { |
511 | begrun = conn->exp_statsn; | ||
512 | } else if (conn->exp_statsn > begrun) { | ||
511 | pr_err("Got Status SNACK Begrun: 0x%08x, RunLength:" | 513 | pr_err("Got Status SNACK Begrun: 0x%08x, RunLength:" |
512 | " 0x%08x but already got ExpStatSN: 0x%08x on CID:" | 514 | " 0x%08x but already got ExpStatSN: 0x%08x on CID:" |
513 | " %hu.\n", begrun, runlength, conn->exp_statsn, | 515 | " %hu.\n", begrun, runlength, conn->exp_statsn, |
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c index 12da9b386169..c3d9df6aaf5f 100644 --- a/drivers/target/target_core_alua.c +++ b/drivers/target/target_core_alua.c | |||
@@ -500,7 +500,7 @@ static inline int core_alua_state_lba_dependent( | |||
500 | 500 | ||
501 | if (segment_mult) { | 501 | if (segment_mult) { |
502 | u64 tmp = lba; | 502 | u64 tmp = lba; |
503 | start_lba = sector_div(tmp, segment_size * segment_mult); | 503 | start_lba = do_div(tmp, segment_size * segment_mult); |
504 | 504 | ||
505 | last_lba = first_lba + segment_size - 1; | 505 | last_lba = first_lba + segment_size - 1; |
506 | if (start_lba >= first_lba && | 506 | if (start_lba >= first_lba && |
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index 2f5d77932c80..3013287a2aaa 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c | |||
@@ -2009,7 +2009,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key, | |||
2009 | struct t10_reservation *pr_tmpl = &dev->t10_pr; | 2009 | struct t10_reservation *pr_tmpl = &dev->t10_pr; |
2010 | unsigned char isid_buf[PR_REG_ISID_LEN], *isid_ptr = NULL; | 2010 | unsigned char isid_buf[PR_REG_ISID_LEN], *isid_ptr = NULL; |
2011 | sense_reason_t ret = TCM_NO_SENSE; | 2011 | sense_reason_t ret = TCM_NO_SENSE; |
2012 | int pr_holder = 0; | 2012 | int pr_holder = 0, type; |
2013 | 2013 | ||
2014 | if (!se_sess || !se_lun) { | 2014 | if (!se_sess || !se_lun) { |
2015 | pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n"); | 2015 | pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n"); |
@@ -2131,6 +2131,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key, | |||
2131 | ret = TCM_RESERVATION_CONFLICT; | 2131 | ret = TCM_RESERVATION_CONFLICT; |
2132 | goto out; | 2132 | goto out; |
2133 | } | 2133 | } |
2134 | type = pr_reg->pr_res_type; | ||
2134 | 2135 | ||
2135 | spin_lock(&pr_tmpl->registration_lock); | 2136 | spin_lock(&pr_tmpl->registration_lock); |
2136 | /* | 2137 | /* |
@@ -2161,6 +2162,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key, | |||
2161 | * Release the calling I_T Nexus registration now.. | 2162 | * Release the calling I_T Nexus registration now.. |
2162 | */ | 2163 | */ |
2163 | __core_scsi3_free_registration(cmd->se_dev, pr_reg, NULL, 1); | 2164 | __core_scsi3_free_registration(cmd->se_dev, pr_reg, NULL, 1); |
2165 | pr_reg = NULL; | ||
2164 | 2166 | ||
2165 | /* | 2167 | /* |
2166 | * From spc4r17, section 5.7.11.3 Unregistering | 2168 | * From spc4r17, section 5.7.11.3 Unregistering |
@@ -2174,8 +2176,8 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key, | |||
2174 | * RESERVATIONS RELEASED. | 2176 | * RESERVATIONS RELEASED. |
2175 | */ | 2177 | */ |
2176 | if (pr_holder && | 2178 | if (pr_holder && |
2177 | (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY || | 2179 | (type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY || |
2178 | pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY)) { | 2180 | type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY)) { |
2179 | list_for_each_entry(pr_reg_p, | 2181 | list_for_each_entry(pr_reg_p, |
2180 | &pr_tmpl->registration_list, | 2182 | &pr_tmpl->registration_list, |
2181 | pr_reg_list) { | 2183 | pr_reg_list) { |
@@ -2194,7 +2196,8 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key, | |||
2194 | ret = core_scsi3_update_and_write_aptpl(dev, aptpl); | 2196 | ret = core_scsi3_update_and_write_aptpl(dev, aptpl); |
2195 | 2197 | ||
2196 | out: | 2198 | out: |
2197 | core_scsi3_put_pr_reg(pr_reg); | 2199 | if (pr_reg) |
2200 | core_scsi3_put_pr_reg(pr_reg); | ||
2198 | return ret; | 2201 | return ret; |
2199 | } | 2202 | } |
2200 | 2203 | ||
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c index fa3cae393e13..a4489444ffbc 100644 --- a/drivers/target/target_core_sbc.c +++ b/drivers/target/target_core_sbc.c | |||
@@ -1074,12 +1074,19 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read, | |||
1074 | struct scatterlist *psg; | 1074 | struct scatterlist *psg; |
1075 | void *paddr, *addr; | 1075 | void *paddr, *addr; |
1076 | unsigned int i, len, left; | 1076 | unsigned int i, len, left; |
1077 | unsigned int offset = 0; | ||
1077 | 1078 | ||
1078 | left = sectors * dev->prot_length; | 1079 | left = sectors * dev->prot_length; |
1079 | 1080 | ||
1080 | for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) { | 1081 | for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) { |
1081 | 1082 | ||
1082 | len = min(psg->length, left); | 1083 | len = min(psg->length, left); |
1084 | if (offset >= sg->length) { | ||
1085 | sg = sg_next(sg); | ||
1086 | offset = 0; | ||
1087 | sg_off = sg->offset; | ||
1088 | } | ||
1089 | |||
1083 | paddr = kmap_atomic(sg_page(psg)) + psg->offset; | 1090 | paddr = kmap_atomic(sg_page(psg)) + psg->offset; |
1084 | addr = kmap_atomic(sg_page(sg)) + sg_off; | 1091 | addr = kmap_atomic(sg_page(sg)) + sg_off; |
1085 | 1092 | ||
@@ -1089,6 +1096,7 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read, | |||
1089 | memcpy(addr, paddr, len); | 1096 | memcpy(addr, paddr, len); |
1090 | 1097 | ||
1091 | left -= len; | 1098 | left -= len; |
1099 | offset += len; | ||
1092 | kunmap_atomic(paddr); | 1100 | kunmap_atomic(paddr); |
1093 | kunmap_atomic(addr); | 1101 | kunmap_atomic(addr); |
1094 | } | 1102 | } |
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c index 43c5ca9878bc..3bebc71ea033 100644 --- a/drivers/target/target_core_spc.c +++ b/drivers/target/target_core_spc.c | |||
@@ -440,8 +440,8 @@ check_scsi_name: | |||
440 | padding = ((-scsi_target_len) & 3); | 440 | padding = ((-scsi_target_len) & 3); |
441 | if (padding) | 441 | if (padding) |
442 | scsi_target_len += padding; | 442 | scsi_target_len += padding; |
443 | if (scsi_name_len > 256) | 443 | if (scsi_target_len > 256) |
444 | scsi_name_len = 256; | 444 | scsi_target_len = 256; |
445 | 445 | ||
446 | buf[off-1] = scsi_target_len; | 446 | buf[off-1] = scsi_target_len; |
447 | off += scsi_target_len; | 447 | off += scsi_target_len; |
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index c50fd9f11aab..24b4f65d8777 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c | |||
@@ -669,9 +669,6 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status) | |||
669 | return; | 669 | return; |
670 | } | 670 | } |
671 | 671 | ||
672 | if (!success) | ||
673 | cmd->transport_state |= CMD_T_FAILED; | ||
674 | |||
675 | /* | 672 | /* |
676 | * Check for case where an explicit ABORT_TASK has been received | 673 | * Check for case where an explicit ABORT_TASK has been received |
677 | * and transport_wait_for_tasks() will be waiting for completion.. | 674 | * and transport_wait_for_tasks() will be waiting for completion.. |
@@ -681,7 +678,7 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status) | |||
681 | spin_unlock_irqrestore(&cmd->t_state_lock, flags); | 678 | spin_unlock_irqrestore(&cmd->t_state_lock, flags); |
682 | complete(&cmd->t_transport_stop_comp); | 679 | complete(&cmd->t_transport_stop_comp); |
683 | return; | 680 | return; |
684 | } else if (cmd->transport_state & CMD_T_FAILED) { | 681 | } else if (!success) { |
685 | INIT_WORK(&cmd->work, target_complete_failure_work); | 682 | INIT_WORK(&cmd->work, target_complete_failure_work); |
686 | } else { | 683 | } else { |
687 | INIT_WORK(&cmd->work, target_complete_ok_work); | 684 | INIT_WORK(&cmd->work, target_complete_ok_work); |
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h index c9c791209cd1..1772fadcff62 100644 --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h | |||
@@ -525,7 +525,6 @@ struct se_cmd { | |||
525 | #define CMD_T_COMPLETE (1 << 2) | 525 | #define CMD_T_COMPLETE (1 << 2) |
526 | #define CMD_T_SENT (1 << 4) | 526 | #define CMD_T_SENT (1 << 4) |
527 | #define CMD_T_STOP (1 << 5) | 527 | #define CMD_T_STOP (1 << 5) |
528 | #define CMD_T_FAILED (1 << 6) | ||
529 | #define CMD_T_DEV_ACTIVE (1 << 7) | 528 | #define CMD_T_DEV_ACTIVE (1 << 7) |
530 | #define CMD_T_REQUEST_STOP (1 << 8) | 529 | #define CMD_T_REQUEST_STOP (1 << 8) |
531 | #define CMD_T_BUSY (1 << 9) | 530 | #define CMD_T_BUSY (1 << 9) |