Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending

Pull scsi target fixes from Nicholas Bellinger:
 "This series include:

   - Close race between iser-target network portal shutdown + accepting
     new connection logins (sagi)
   - Fix free-after-use regression in tcm_fc post conversion to
     percpu-ida pre-allocation (nab)
   - Explicitly disable Immediate + Unsolicited Data for iser-target
     connections when T10-PI is enabled (sagi + nab)
   - Allow pi_prot_type + emulate_write_cache attributes to be set to
     zero regardless of backend support (andy)
   - memory leak fix (mikulas)"

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  target: fix memory leak on XCOPY
  target: Don't allow setting WC emulation if device doesn't support
  iscsi-target: Disable Immediate + Unsolicited Data with ISER Protection
  tcm_fc: Fix free-after-use regression in ft_free_cmd
  iscsi-target: Change BUG_ON to REJECT in iscsit_process_nop_out
  Target/iscsi,iser: Avoid accepting transport connections during stop stage
  Target/iser: Fix iscsit_accept_np and rdma_cm racy flow
  Target/iser: Fix wrong connection requests list addition
  target: Allow non-supporting backends to set pi_prot_type to 0

9 files changed, 63 insertions, 33 deletions

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index c98fdb185931..a1710465faaf 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -28,6 +28,7 @@
 #include <target/target_core_base.h>
 #include <target/target_core_fabric.h>
 #include <target/iscsi/iscsi_transport.h>
+#include <linux/semaphore.h>
 
 #include "isert_proto.h"
 #include "ib_isert.h"
@@ -561,7 +562,15 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         struct isert_device *device;
         struct ib_device *ib_dev = cma_id->device;
         int ret = 0;
-        u8 pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
+        u8 pi_support;
+
+        spin_lock_bh(&np->np_thread_lock);
+        if (!np->enabled) {
+                spin_unlock_bh(&np->np_thread_lock);
+                pr_debug("iscsi_np is not enabled, reject connect request\n");
+                return rdma_reject(cma_id, NULL, 0);
+        }
+        spin_unlock_bh(&np->np_thread_lock);
 
         pr_debug("Entering isert_connect_request cma_id: %p, context: %p\n",
                  cma_id, cma_id->context);
@@ -652,6 +661,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 goto out_mr;
         }
 
+        pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
         if (pi_support && !device->pi_capable) {
                 pr_err("Protection information requested but not supported\n");
                 ret = -EINVAL;
@@ -663,11 +673,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 goto out_conn_dev;
 
         mutex_lock(&isert_np->np_accept_mutex);
-        list_add_tail(&isert_np->np_accept_list, &isert_conn->conn_accept_node);
+        list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list);
         mutex_unlock(&isert_np->np_accept_mutex);
 
-        pr_debug("isert_connect_request() waking up np_accept_wq: %p\n", np);
-        wake_up(&isert_np->np_accept_wq);
+        pr_debug("isert_connect_request() up np_sem np: %p\n", np);
+        up(&isert_np->np_sem);
         return 0;
 
 out_conn_dev:
@@ -2999,7 +3009,7 @@ isert_setup_np(struct iscsi_np *np,
                 pr_err("Unable to allocate struct isert_np\n");
                 return -ENOMEM;
         }
-        init_waitqueue_head(&isert_np->np_accept_wq);
+        sema_init(&isert_np->np_sem, 0);
         mutex_init(&isert_np->np_accept_mutex);
         INIT_LIST_HEAD(&isert_np->np_accept_list);
         init_completion(&isert_np->np_login_comp);
@@ -3048,18 +3058,6 @@ out:
 }
 
 static int
-isert_check_accept_queue(struct isert_np *isert_np)
-{
-        int empty;
-
-        mutex_lock(&isert_np->np_accept_mutex);
-        empty = list_empty(&isert_np->np_accept_list);
-        mutex_unlock(&isert_np->np_accept_mutex);
-
-        return empty;
-}
-
-static int
 isert_rdma_accept(struct isert_conn *isert_conn)
 {
         struct rdma_cm_id *cm_id = isert_conn->conn_cm_id;
@@ -3151,16 +3149,14 @@ isert_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
         int max_accept = 0, ret;
 
 accept_wait:
-        ret = wait_event_interruptible(isert_np->np_accept_wq,
-                        !isert_check_accept_queue(isert_np) ||
-                        np->np_thread_state == ISCSI_NP_THREAD_RESET);
+        ret = down_interruptible(&isert_np->np_sem);
         if (max_accept > 5)
                 return -ENODEV;
 
         spin_lock_bh(&np->np_thread_lock);
         if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                 spin_unlock_bh(&np->np_thread_lock);
-                pr_err("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
+                pr_debug("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
                 return -ENODEV;
         }
         spin_unlock_bh(&np->np_thread_lock);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 4c072ae34c01..da6612e68000 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -182,7 +182,7 @@ struct isert_device {
 };
 
 struct isert_np {
-        wait_queue_head_t       np_accept_wq;
+        struct semaphore        np_sem;
         struct rdma_cm_id       *np_cm_id;
         struct mutex            np_accept_mutex;
         struct list_head        np_accept_list;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 78cab13bbb1b..46588c85d39b 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1593,7 +1593,9 @@ int iscsit_process_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
          * Initiator is expecting a NopIN ping reply..
          */
         if (hdr->itt != RESERVED_ITT) {
-                BUG_ON(!cmd);
+                if (!cmd)
+                        return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
+                                                (unsigned char *)hdr);
 
                 spin_lock_bh(&conn->cmd_lock);
                 list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
index 6960f22909ae..302eb3b78715 100644
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -775,6 +775,7 @@ struct iscsi_np {
         int                     np_ip_proto;
         int                     np_sock_type;
         enum np_thread_state_table np_thread_state;
+        bool                    enabled;
         enum iscsi_timer_flags_table np_login_timer_flags;
         u32                     np_exports;
         enum np_flags_table     np_flags;
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 8739b98f6f93..ca31fa1b8a4b 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -436,7 +436,7 @@ static int iscsi_login_zero_tsih_s2(
                 }
                 off = mrdsl % PAGE_SIZE;
                 if (!off)
-                        return 0;
+                        goto check_prot;
 
                 if (mrdsl < PAGE_SIZE)
                         mrdsl = PAGE_SIZE;
@@ -452,6 +452,31 @@ static int iscsi_login_zero_tsih_s2(
                                 ISCSI_LOGIN_STATUS_NO_RESOURCES);
                         return -1;
                 }
+                /*
+                 * ISER currently requires that ImmediateData + Unsolicited
+                 * Data be disabled when protection / signature MRs are enabled.
+                 */
+check_prot:
+                if (sess->se_sess->sup_prot_ops &
+                   (TARGET_PROT_DOUT_STRIP | TARGET_PROT_DOUT_PASS |
+                    TARGET_PROT_DOUT_INSERT)) {
+
+                        sprintf(buf, "ImmediateData=No");
+                        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
+                                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                                    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                                return -1;
+                        }
+
+                        sprintf(buf, "InitialR2T=Yes");
+                        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
+                                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                                    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                                return -1;
+                        }
+                        pr_debug("Forcing ImmediateData=No + InitialR2T=Yes for"
+                                 " T10-PI enabled ISER session\n");
+                }
         }
 
         return 0;
@@ -984,6 +1009,7 @@ int iscsi_target_setup_login_socket(
         }
 
         np->np_transport = t;
+        np->enabled = true;
         return 0;
 }
 
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index eb96b20dc09e..ca1811858afd 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -184,6 +184,7 @@ static void iscsit_clear_tpg_np_login_thread(
                 return;
         }
 
+        tpg_np->tpg_np->enabled = false;
         iscsit_reset_np_thread(tpg_np->tpg_np, tpg_np, tpg, shutdown);
 }
 
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 65001e133670..26416c15d65c 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -798,10 +798,10 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
                 pr_err("emulate_write_cache not supported for pSCSI\n");
                 return -EINVAL;
         }
-        if (dev->transport->get_write_cache) {
-                pr_warn("emulate_write_cache cannot be changed when underlying"
-                        " HW reports WriteCacheEnabled, ignoring request\n");
-                return 0;
+        if (flag &&
+            dev->transport->get_write_cache) {
+                pr_err("emulate_write_cache not supported for this device\n");
+                return -EINVAL;
         }
 
         dev->dev_attrib.emulate_write_cache = flag;
@@ -936,6 +936,10 @@ int se_dev_set_pi_prot_type(struct se_device *dev, int flag)
                 return 0;
         }
         if (!dev->transport->init_prot || !dev->transport->free_prot) {
+                /* 0 is only allowed value for non-supporting backends */
+                if (flag == 0)
+                        return 0;
+
                 pr_err("DIF protection not supported by backend: %s\n",
                        dev->transport->name);
                 return -ENOSYS;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index d4b98690a736..789aa9eb0a1e 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1113,6 +1113,7 @@ void transport_init_se_cmd(
         init_completion(&cmd->cmd_wait_comp);
         init_completion(&cmd->task_stop_comp);
         spin_lock_init(&cmd->t_state_lock);
+        kref_init(&cmd->cmd_kref);
         cmd->transport_state = CMD_T_DEV_ACTIVE;
 
         cmd->se_tfo = tfo;
@@ -2357,7 +2358,6 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
         unsigned long flags;
         int ret = 0;
 
-        kref_init(&se_cmd->cmd_kref);
         /*
          * Add a second kref if the fabric caller is expecting to handle
          * fabric acknowledgement that requires two target_put_sess_cmd()
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 01cf37f212c3..f5fd515b2bee 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -90,18 +90,18 @@ static void ft_free_cmd(struct ft_cmd *cmd)
 {
         struct fc_frame *fp;
         struct fc_lport *lport;
-        struct se_session *se_sess;
+        struct ft_sess *sess;
 
         if (!cmd)
                 return;
-        se_sess = cmd->sess->se_sess;
+        sess = cmd->sess;
         fp = cmd->req_frame;
         lport = fr_dev(fp);
         if (fr_seq(fp))
                 lport->tt.seq_release(fr_seq(fp));
         fc_frame_free(fp);
-        percpu_ida_free(&se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
-        ft_sess_put(cmd->sess); /* undo get from lookup at recv */
+        percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
+        ft_sess_put(sess);      /* undo get from lookup at recv */
 }
 
 void ft_release_cmd(struct se_cmd *se_cmd)