6 files changed, 23 insertions, 10 deletions

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 5663f4d19d02..1f4c794f5fcc 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1309,7 +1309,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
         if (cmd->data_direction != DMA_TO_DEVICE) {
                 pr_err("Command ITT: 0x%08x received DataOUT for a"
                         " NON-WRITE command.\n", cmd->init_task_tag);
-                return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
+                return iscsit_dump_data_payload(conn, payload_length, 1);
         }
         se_cmd = &cmd->se_cmd;
         iscsit_mod_dataout_timer(cmd);
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 19b842c3e0b3..ab4915c0d933 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -174,7 +174,6 @@ static int chap_server_compute_md5(
         char *nr_out_ptr,
         unsigned int *nr_out_len)
 {
-        char *endptr;
         unsigned long id;
         unsigned char id_as_uchar;
         unsigned char digest[MD5_SIGNATURE_SIZE];
@@ -320,9 +319,14 @@ static int chap_server_compute_md5(
         }
 
         if (type == HEX)
-                id = simple_strtoul(&identifier[2], &endptr, 0);
+                ret = kstrtoul(&identifier[2], 0, &id);
         else
-                id = simple_strtoul(identifier, &endptr, 0);
+                ret = kstrtoul(identifier, 0, &id);
+
+        if (ret < 0) {
+                pr_err("kstrtoul() failed for CHAP identifier: %d\n", ret);
+                goto out;
+        }
         if (id > 255) {
                 pr_err("chap identifier: %lu greater than 255\n", id);
                 goto out;
@@ -351,6 +355,10 @@ static int chap_server_compute_md5(
                 pr_err("Unable to convert incoming challenge\n");
                 goto out;
         }
+        if (challenge_len > 1024) {
+                pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
+                goto out;
+        }
         /*
          * During mutual authentication, the CHAP_C generated by the
          * initiator must not match the original CHAP_C generated by
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index fecb69535a15..5e71ac609418 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1216,7 +1216,7 @@ old_sess_out:
 static int __iscsi_target_login_thread(struct iscsi_np *np)
 {
         u8 *buffer, zero_tsih = 0;
-        int ret = 0, rc, stop;
+        int ret = 0, rc;
         struct iscsi_conn *conn = NULL;
         struct iscsi_login *login;
         struct iscsi_portal_group *tpg = NULL;
@@ -1230,6 +1230,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                 np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                 complete(&np->np_restart_comp);
+        } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
+                spin_unlock_bh(&np->np_thread_lock);
+                goto exit;
         } else {
                 np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
         }
@@ -1422,10 +1425,8 @@ old_sess_out:
         }
 
 out:
-        stop = kthread_should_stop();
-        /* Wait for another socket.. */
-        if (!stop)
-                return 1;
+        return 1;
+
 exit:
         iscsi_stop_login_thread_timer(np);
         spin_lock_bh(&np->np_thread_lock);
@@ -1442,7 +1443,7 @@ int iscsi_target_login_thread(void *arg)
 
         allow_signal(SIGINT);
 
-        while (!kthread_should_stop()) {
+        while (1) {
                 ret = __iscsi_target_login_thread(np);
                 /*
                  * We break and exit here unless another sock_accept() call
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 53e157cb8c54..fd90b28f1d94 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -1295,6 +1295,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta
         login->login_failed = 1;
         iscsit_collect_login_stats(conn, status_class, status_detail);
 
+        memset(&login->rsp[0], 0, ISCSI_HDR_LEN);
+
         hdr     = (struct iscsi_login_rsp *)&login->rsp[0];
         hdr->opcode             = ISCSI_OP_LOGIN_RSP;
         hdr->status_class       = status_class;
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 6d2f37578b29..8c64b8776a96 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -239,6 +239,7 @@ static void tcm_loop_submission_work(struct work_struct *work)
         return;
 
 out_done:
+        kmem_cache_free(tcm_loop_cmd_cache, tl_cmd);
         sc->scsi_done(sc);
         return;
 }
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 11d26fe65bfb..98da90167159 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -616,6 +616,7 @@ void core_dev_unexport(
         dev->export_count--;
         spin_unlock(&hba->device_lock);
 
+        lun->lun_sep = NULL;
         lun->lun_se_dev = NULL;
 }