Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending

Pull SCSI target updates from Nicholas Bellinger:
 "The highlights this round include:

   - Add support for T10 PI pass-through between vhost-scsi +
     virtio-scsi (MST + Paolo + MKP + nab)
   - Add support for T10 PI in qla2xxx target mode (Quinn + MKP + hch +
     nab, merged through scsi.git)
   - Add support for percpu-ida pre-allocation in qla2xxx target code
     (Quinn + nab)
   - A number of iser-target fixes related to hardening the network
     portal shutdown path (Sagi + Slava)
   - Fix response length residual handling for a number of control CDBs
     (Roland + Christophe V.)
   - Various iscsi RFC conformance fixes in the CHAP authentication path
     (Tejas and Calsoft folks + nab)
   - Return TASK_SET_FULL status for tcm_fc(FCoE) DataIn + Response
     failures (Vasu + Jun + nab)
   - Fix long-standing ABORT_TASK + session reset hang (nab)
   - Convert iser-initiator + iser-target to include T10 bytes into EDTL
     (Sagi + Or + MKP + Mike Christie)
   - Fix NULL pointer dereference regression related to XCOPY introduced
     in v3.15 + CC'ed to v3.12.y (nab)"

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (34 commits)
  target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd
  vhost-scsi: Include prot_bytes into expected data transfer length
  TARGET/sbc,loopback: Adjust command data length in case pi exists on the wire
  libiscsi, iser: Adjust data_length to include protection information
  scsi_cmnd: Introduce scsi_transfer_length helper
  target: Report correct response length for some commands
  target/sbc: Check that the LBA and number of blocks are correct in VERIFY
  target/sbc: Remove sbc_check_valid_sectors()
  Target/iscsi: Fix sendtargets response pdu for iser transport
  Target/iser: Fix a wrong dereference in case discovery session is over iser
  iscsi-target: Fix ABORT_TASK + connection reset iscsi_queue_req memory leak
  target: Use complete_all for se_cmd->t_transport_stop_comp
  target: Set CMD_T_ACTIVE bit for Task Management Requests
  target: cleanup some boolean tests
  target/spc: Simplify INQUIRY EVPD=0x80
  tcm_fc: Generate TASK_SET_FULL status for response failures
  tcm_fc: Generate TASK_SET_FULL status for DataIN failures
  iscsi-target: Reject mutual authentication with reflected CHAP_C
  iscsi-target: Remove no-op from iscsit_tpg_del_portal_group
  iscsi-target: Fix CHAP_A parameter list handling
  ...

8 files changed, 98 insertions, 43 deletions

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 9189bc0a87ae..5663f4d19d02 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -300,7 +300,7 @@ bool iscsit_check_np_match(
                 port = ntohs(sock_in->sin_port);
         }
 
-        if ((ip_match == true) && (np->np_port == port) &&
+        if (ip_match && (np->np_port == port) &&
             (np->np_network_transport == network_transport))
                 return true;
 
@@ -325,7 +325,7 @@ static struct iscsi_np *iscsit_get_np(
                 }
 
                 match = iscsit_check_np_match(sockaddr, np, network_transport);
-                if (match == true) {
+                if (match) {
                         /*
                          * Increment the np_exports reference count now to
                          * prevent iscsit_del_np() below from being called
@@ -1121,7 +1121,7 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
         /*
          * Special case for Unsupported SAM WRITE Opcodes and ImmediateData=Yes.
          */
-        if (dump_payload == true)
+        if (dump_payload)
                 goto after_immediate_data;
 
         immed_ret = iscsit_handle_immediate_data(cmd, hdr,
@@ -3390,7 +3390,9 @@ static bool iscsit_check_inaddr_any(struct iscsi_np *np)
 
 #define SENDTARGETS_BUF_LIMIT 32768U
 
-static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
+static int
+iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
+                                  enum iscsit_transport_type network_transport)
 {
         char *payload = NULL;
         struct iscsi_conn *conn = cmd->conn;
@@ -3467,6 +3469,9 @@ static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
                                 struct iscsi_np *np = tpg_np->tpg_np;
                                 bool inaddr_any = iscsit_check_inaddr_any(np);
 
+                                if (np->np_network_transport != network_transport)
+                                        continue;
+
                                 if (!target_name_printed) {
                                         len = sprintf(buf, "TargetName=%s",
                                                       tiqn->tiqn);
@@ -3485,10 +3490,8 @@ static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
 
                                 len = sprintf(buf, "TargetAddress="
                                         "%s:%hu,%hu",
-                                        (inaddr_any == false) ?
-                                                np->np_ip : conn->local_ip,
-                                        (inaddr_any == false) ?
-                                                np->np_port : conn->local_port,
+                                        inaddr_any ? conn->local_ip : np->np_ip,
+                                        inaddr_any ? conn->local_port : np->np_port,
                                         tpg->tpgt);
                                 len += 1;
 
@@ -3520,11 +3523,12 @@ eob:
 
 int
 iscsit_build_text_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
-                      struct iscsi_text_rsp *hdr)
+                      struct iscsi_text_rsp *hdr,
+                      enum iscsit_transport_type network_transport)
 {
         int text_length, padding;
 
-        text_length = iscsit_build_sendtargets_response(cmd);
+        text_length = iscsit_build_sendtargets_response(cmd, network_transport);
         if (text_length < 0)
                 return text_length;
 
@@ -3562,7 +3566,7 @@ static int iscsit_send_text_rsp(
         u32 tx_size = 0;
         int text_length, iov_count = 0, rc;
 
-        rc = iscsit_build_text_rsp(cmd, conn, hdr);
+        rc = iscsit_build_text_rsp(cmd, conn, hdr, ISCSI_TCP);
         if (rc < 0)
                 return rc;
 
@@ -4234,8 +4238,6 @@ int iscsit_close_connection(
         if (conn->conn_transport->iscsit_wait_conn)
                 conn->conn_transport->iscsit_wait_conn(conn);
 
-        iscsit_free_queue_reqs_for_conn(conn);
-
         /*
          * During Connection recovery drop unacknowledged out of order
          * commands for this connection, and prepare the other commands
@@ -4252,6 +4254,7 @@ int iscsit_close_connection(
                 iscsit_clear_ooo_cmdsns_for_conn(conn);
                 iscsit_release_commands_from_conn(conn);
         }
+        iscsit_free_queue_reqs_for_conn(conn);
 
         /*
          * Handle decrementing session or connection usage count if
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index de77d9aa22c6..19b842c3e0b3 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -71,6 +71,40 @@ static void chap_gen_challenge(
                         challenge_asciihex);
 }
 
+static int chap_check_algorithm(const char *a_str)
+{
+        char *tmp, *orig, *token;
+
+        tmp = kstrdup(a_str, GFP_KERNEL);
+        if (!tmp) {
+                pr_err("Memory allocation failed for CHAP_A temporary buffer\n");
+                return CHAP_DIGEST_UNKNOWN;
+        }
+        orig = tmp;
+
+        token = strsep(&tmp, "=");
+        if (!token)
+                goto out;
+
+        if (strcmp(token, "CHAP_A")) {
+                pr_err("Unable to locate CHAP_A key\n");
+                goto out;
+        }
+        while (token) {
+                token = strsep(&tmp, ",");
+                if (!token)
+                        goto out;
+
+                if (!strncmp(token, "5", 1)) {
+                        pr_debug("Selected MD5 Algorithm\n");
+                        kfree(orig);
+                        return CHAP_DIGEST_MD5;
+                }
+        }
+out:
+        kfree(orig);
+        return CHAP_DIGEST_UNKNOWN;
+}
 
 static struct iscsi_chap *chap_server_open(
         struct iscsi_conn *conn,
@@ -79,6 +113,7 @@ static struct iscsi_chap *chap_server_open(
         char *aic_str,
         unsigned int *aic_len)
 {
+        int ret;
         struct iscsi_chap *chap;
 
         if (!(auth->naf_flags & NAF_USERID_SET) ||
@@ -93,21 +128,24 @@ static struct iscsi_chap *chap_server_open(
                 return NULL;
 
         chap = conn->auth_protocol;
-        /*
-         * We only support MD5 MDA presently.
-         */
-        if (strncmp(a_str, "CHAP_A=5", 8)) {
-                pr_err("CHAP_A is not MD5.\n");
+        ret = chap_check_algorithm(a_str);
+        switch (ret) {
+        case CHAP_DIGEST_MD5:
+                pr_debug("[server] Got CHAP_A=5\n");
+                /*
+                 * Send back CHAP_A set to MD5.
+                */
+                *aic_len = sprintf(aic_str, "CHAP_A=5");
+                *aic_len += 1;
+                chap->digest_type = CHAP_DIGEST_MD5;
+                pr_debug("[server] Sending CHAP_A=%d\n", chap->digest_type);
+                break;
+        case CHAP_DIGEST_UNKNOWN:
+        default:
+                pr_err("Unsupported CHAP_A value\n");
                 return NULL;
         }
-        pr_debug("[server] Got CHAP_A=5\n");
-        /*
-         * Send back CHAP_A set to MD5.
-         */
-        *aic_len = sprintf(aic_str, "CHAP_A=5");
-        *aic_len += 1;
-        chap->digest_type = CHAP_DIGEST_MD5;
-        pr_debug("[server] Sending CHAP_A=%d\n", chap->digest_type);
+
         /*
          * Set Identifier.
          */
@@ -314,6 +352,16 @@ static int chap_server_compute_md5(
                 goto out;
         }
         /*
+         * During mutual authentication, the CHAP_C generated by the
+         * initiator must not match the original CHAP_C generated by
+         * the target.
+         */
+        if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) {
+                pr_err("initiator CHAP_C matches target CHAP_C, failing"
+                       " login attempt\n");
+                goto out;
+        }
+        /*
          * Generate CHAP_N and CHAP_R for mutual authentication.
          */
         tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
diff --git a/drivers/target/iscsi/iscsi_target_auth.h b/drivers/target/iscsi/iscsi_target_auth.h
index 2f463c09626d..d22f7b96a06c 100644
--- a/drivers/target/iscsi/iscsi_target_auth.h
+++ b/drivers/target/iscsi/iscsi_target_auth.h
@@ -1,6 +1,7 @@
 #ifndef _ISCSI_CHAP_H_
 #define _ISCSI_CHAP_H_
 
+#define CHAP_DIGEST_UNKNOWN     0
 #define CHAP_DIGEST_MD5         5
 #define CHAP_DIGEST_SHA         6
 
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index d9b1d88e1ad3..fecb69535a15 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1145,7 +1145,7 @@ iscsit_conn_set_transport(struct iscsi_conn *conn, struct iscsit_transport *t)
 void iscsi_target_login_sess_out(struct iscsi_conn *conn,
                 struct iscsi_np *np, bool zero_tsih, bool new_sess)
 {
-        if (new_sess == false)
+        if (!new_sess)
                 goto old_sess_out;
 
         pr_err("iSCSI Login negotiation failed.\n");
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 75b685960e80..62a095f36bf2 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -404,7 +404,7 @@ static void iscsi_target_sk_data_ready(struct sock *sk)
         }
 
         rc = schedule_delayed_work(&conn->login_work, 0);
-        if (rc == false) {
+        if (!rc) {
                 pr_debug("iscsi_target_sk_data_ready, schedule_delayed_work"
                          " got false\n");
         }
@@ -513,7 +513,7 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
         state = (tpg->tpg_state == TPG_STATE_ACTIVE);
         spin_unlock(&tpg->tpg_state_lock);
 
-        if (state == false) {
+        if (!state) {
                 pr_debug("iscsi_target_do_login_rx: tpg_state != TPG_STATE_ACTIVE\n");
                 iscsi_target_restore_sock_callbacks(conn);
                 iscsi_target_login_drop(conn, login);
@@ -528,7 +528,7 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
                 state = iscsi_target_sk_state_check(sk);
                 read_unlock_bh(&sk->sk_callback_lock);
 
-                if (state == false) {
+                if (!state) {
                         pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
                         iscsi_target_restore_sock_callbacks(conn);
                         iscsi_target_login_drop(conn, login);
@@ -773,6 +773,12 @@ static int iscsi_target_handle_csg_zero(
                 }
 
                 goto do_auth;
+        } else if (!payload_length) {
+                pr_err("Initiator sent zero length security payload,"
+                       " login failed\n");
+                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_INITIATOR_ERR,
+                                    ISCSI_LOGIN_STATUS_AUTH_FAILED);
+                return -1;
         }
 
         if (login->first_request)
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index 4d2e23fc76fd..02f9de26f38a 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -474,10 +474,10 @@ int iscsi_set_keys_to_negotiate(
                 if (!strcmp(param->name, AUTHMETHOD)) {
                         SET_PSTATE_NEGOTIATE(param);
                 } else if (!strcmp(param->name, HEADERDIGEST)) {
-                        if (iser == false)
+                        if (!iser)
                                 SET_PSTATE_NEGOTIATE(param);
                 } else if (!strcmp(param->name, DATADIGEST)) {
-                        if (iser == false)
+                        if (!iser)
                                 SET_PSTATE_NEGOTIATE(param);
                 } else if (!strcmp(param->name, MAXCONNECTIONS)) {
                         SET_PSTATE_NEGOTIATE(param);
@@ -497,7 +497,7 @@ int iscsi_set_keys_to_negotiate(
                 } else if (!strcmp(param->name, IMMEDIATEDATA)) {
                         SET_PSTATE_NEGOTIATE(param);
                 } else if (!strcmp(param->name, MAXRECVDATASEGMENTLENGTH)) {
-                        if (iser == false)
+                        if (!iser)
                                 SET_PSTATE_NEGOTIATE(param);
                 } else if (!strcmp(param->name, MAXXMITDATASEGMENTLENGTH)) {
                         continue;
@@ -528,13 +528,13 @@ int iscsi_set_keys_to_negotiate(
                 } else if (!strcmp(param->name, OFMARKINT)) {
                         SET_PSTATE_NEGOTIATE(param);
                 } else if (!strcmp(param->name, RDMAEXTENSIONS)) {
-                        if (iser == true)
+                        if (iser)
                                 SET_PSTATE_NEGOTIATE(param);
                 } else if (!strcmp(param->name, INITIATORRECVDATASEGMENTLENGTH)) {
-                        if (iser == true)
+                        if (iser)
                                 SET_PSTATE_NEGOTIATE(param);
                 } else if (!strcmp(param->name, TARGETRECVDATASEGMENTLENGTH)) {
-                        if (iser == true)
+                        if (iser)
                                 SET_PSTATE_NEGOTIATE(param);
                 }
         }
@@ -1605,7 +1605,7 @@ int iscsi_decode_text_input(
 
         tmpbuf = kzalloc(length + 1, GFP_KERNEL);
         if (!tmpbuf) {
-                pr_err("Unable to allocate memory for tmpbuf.\n");
+                pr_err("Unable to allocate %u + 1 bytes for tmpbuf.\n", length);
                 return -1;
         }
 
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index 1431e8400d28..c3cb5c15efda 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -189,7 +189,7 @@ static void iscsit_clear_tpg_np_login_thread(
         iscsit_reset_np_thread(tpg_np->tpg_np, tpg_np, tpg, shutdown);
 }
 
-void iscsit_clear_tpg_np_login_threads(
+static void iscsit_clear_tpg_np_login_threads(
         struct iscsi_portal_group *tpg,
         bool shutdown)
 {
@@ -276,8 +276,6 @@ int iscsit_tpg_del_portal_group(
         tpg->tpg_state = TPG_STATE_INACTIVE;
         spin_unlock(&tpg->tpg_state_lock);
 
-        iscsit_clear_tpg_np_login_threads(tpg, true);
-
         if (iscsit_release_sessions_for_tpg(tpg, force) < 0) {
                 pr_err("Unable to delete iSCSI Target Portal Group:"
                         " %hu while active sessions exist, and force=0\n",
@@ -453,7 +451,7 @@ static bool iscsit_tpg_check_network_portal(
 
                         match = iscsit_check_np_match(sockaddr, np,
                                                 network_transport);
-                        if (match == true)
+                        if (match)
                                 break;
                 }
                 spin_unlock(&tpg->tpg_np_lock);
@@ -475,7 +473,7 @@ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
 
         if (!tpg_np_parent) {
                 if (iscsit_tpg_check_network_portal(tpg->tpg_tiqn, sockaddr,
-                                network_transport) == true) {
+                                network_transport)) {
                         pr_err("Network Portal: %s already exists on a"
                                 " different TPG on %s\n", ip_str,
                                 tpg->tpg_tiqn->tiqn);
diff --git a/drivers/target/iscsi/iscsi_target_tpg.h b/drivers/target/iscsi/iscsi_target_tpg.h
index 0a182f2aa8a2..e7265337bc43 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.h
+++ b/drivers/target/iscsi/iscsi_target_tpg.h
@@ -8,7 +8,6 @@ extern struct iscsi_portal_group *iscsit_get_tpg_from_np(struct iscsi_tiqn *,
                         struct iscsi_np *, struct iscsi_tpg_np **);
 extern int iscsit_get_tpg(struct iscsi_portal_group *);
 extern void iscsit_put_tpg(struct iscsi_portal_group *);
-extern void iscsit_clear_tpg_np_login_threads(struct iscsi_portal_group *, bool);
 extern void iscsit_tpg_dump_params(struct iscsi_portal_group *);
 extern int iscsit_tpg_add_portal_group(struct iscsi_tiqn *, struct iscsi_portal_group *);
 extern int iscsit_tpg_del_portal_group(struct iscsi_tiqn *, struct iscsi_portal_group *,