9 files changed, 59 insertions, 37 deletions

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 7f1a7ce4b771..b83ec378d04f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -785,7 +785,7 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
         spin_unlock_bh(&conn->cmd_lock);
 
         list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 iscsit_free_cmd(cmd, false);
         }
 }
@@ -3708,7 +3708,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state
                 break;
         case ISTATE_REMOVE:
                 spin_lock_bh(&conn->cmd_lock);
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_free_cmd(cmd, false);
@@ -4151,7 +4151,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
         spin_lock_bh(&conn->cmd_lock);
         list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_increment_maxcmdsn(cmd, sess);
@@ -4196,6 +4196,10 @@ int iscsit_close_connection(
         iscsit_stop_timers_for_cmds(conn);
         iscsit_stop_nopin_response_timer(conn);
         iscsit_stop_nopin_timer(conn);
+
+        if (conn->conn_transport->iscsit_wait_conn)
+                conn->conn_transport->iscsit_wait_conn(conn);
+
         iscsit_free_queue_reqs_for_conn(conn);
 
         /*
diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
index e048d6439f4a..cda4d80cfaef 100644
--- a/drivers/target/iscsi/iscsi_target_erl1.c
+++ b/drivers/target/iscsi/iscsi_target_erl1.c
@@ -507,7 +507,9 @@ int iscsit_handle_status_snack(
         u32 last_statsn;
         int found_cmd;
 
-        if (conn->exp_statsn > begrun) {
+        if (!begrun) {
+                begrun = conn->exp_statsn;
+        } else if (conn->exp_statsn > begrun) {
                 pr_err("Got Status SNACK Begrun: 0x%08x, RunLength:"
                         " 0x%08x but already got ExpStatSN: 0x%08x on CID:"
                         " %hu.\n", begrun, runlength, conn->exp_statsn,
diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
index 33be1fb1df32..4ca8fd2a70db 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.c
+++ b/drivers/target/iscsi/iscsi_target_erl2.c
@@ -138,7 +138,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                 list_for_each_entry_safe(cmd, cmd_tmp,
                                 &cr->conn_recovery_cmd_list, i_conn_node) {
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         cmd->conn = NULL;
                         spin_unlock(&cr->conn_recovery_cmd_lock);
                         iscsit_free_cmd(cmd, true);
@@ -160,7 +160,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                 list_for_each_entry_safe(cmd, cmd_tmp,
                                 &cr->conn_recovery_cmd_list, i_conn_node) {
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         cmd->conn = NULL;
                         spin_unlock(&cr->conn_recovery_cmd_lock);
                         iscsit_free_cmd(cmd, true);
@@ -216,7 +216,7 @@ int iscsit_remove_cmd_from_connection_recovery(
         }
         cr = cmd->cr;
 
-        list_del(&cmd->i_conn_node);
+        list_del_init(&cmd->i_conn_node);
         return --cr->cmd_count;
 }
 
@@ -297,7 +297,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
                 if (!(cmd->cmd_flags & ICF_OOO_CMDSN))
                         continue;
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
 
                 spin_unlock_bh(&conn->cmd_lock);
                 iscsit_free_cmd(cmd, true);
@@ -335,7 +335,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
         /*
          * Only perform connection recovery on ISCSI_OP_SCSI_CMD or
          * ISCSI_OP_NOOP_OUT opcodes.  For all other opcodes call
-         * list_del(&cmd->i_conn_node); to release the command to the
+         * list_del_init(&cmd->i_conn_node); to release the command to the
          * session pool and remove it from the connection's list.
          *
          * Also stop the DataOUT timer, which will be restarted after
@@ -351,7 +351,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                                 " CID: %hu\n", cmd->iscsi_opcode,
                                 cmd->init_task_tag, cmd->cmd_sn, conn->cid);
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
                         iscsit_free_cmd(cmd, true);
                         spin_lock_bh(&conn->cmd_lock);
@@ -371,7 +371,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                  */
                 if (!(cmd->cmd_flags & ICF_OOO_CMDSN) && !cmd->immediate_cmd &&
                      iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
                         iscsit_free_cmd(cmd, true);
                         spin_lock_bh(&conn->cmd_lock);
@@ -393,7 +393,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
 
                 cmd->sess = conn->sess;
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_free_all_datain_reqs(cmd);
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index 39761837608d..44a5471de00f 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -137,7 +137,7 @@ struct iscsi_portal_group *iscsit_get_tpg_from_np(
         list_for_each_entry(tpg, &tiqn->tiqn_tpg_list, tpg_list) {
 
                 spin_lock(&tpg->tpg_state_lock);
-                if (tpg->tpg_state == TPG_STATE_FREE) {
+                if (tpg->tpg_state != TPG_STATE_ACTIVE) {
                         spin_unlock(&tpg->tpg_state_lock);
                         continue;
                 }
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 12da9b386169..c3d9df6aaf5f 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -500,7 +500,7 @@ static inline int core_alua_state_lba_dependent(
 
                         if (segment_mult) {
                                 u64 tmp = lba;
-                                start_lba = sector_div(tmp, segment_size * segment_mult);
+                                start_lba = do_div(tmp, segment_size * segment_mult);
 
                                 last_lba = first_lba + segment_size - 1;
                                 if (start_lba >= first_lba &&
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 2f5d77932c80..3013287a2aaa 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -2009,7 +2009,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
         struct t10_reservation *pr_tmpl = &dev->t10_pr;
         unsigned char isid_buf[PR_REG_ISID_LEN], *isid_ptr = NULL;
         sense_reason_t ret = TCM_NO_SENSE;
-        int pr_holder = 0;
+        int pr_holder = 0, type;
 
         if (!se_sess || !se_lun) {
                 pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
@@ -2131,6 +2131,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
                         ret = TCM_RESERVATION_CONFLICT;
                         goto out;
                 }
+                type = pr_reg->pr_res_type;
 
                 spin_lock(&pr_tmpl->registration_lock);
                 /*
@@ -2161,6 +2162,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
                  * Release the calling I_T Nexus registration now..
                  */
                 __core_scsi3_free_registration(cmd->se_dev, pr_reg, NULL, 1);
+                pr_reg = NULL;
 
                 /*
                  * From spc4r17, section 5.7.11.3 Unregistering
@@ -2174,8 +2176,8 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
                  * RESERVATIONS RELEASED.
                  */
                 if (pr_holder &&
-                    (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY ||
-                     pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY)) {
+                    (type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY ||
+                     type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY)) {
                         list_for_each_entry(pr_reg_p,
                                         &pr_tmpl->registration_list,
                                         pr_reg_list) {
@@ -2194,7 +2196,8 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
         ret = core_scsi3_update_and_write_aptpl(dev, aptpl);
 
 out:
-        core_scsi3_put_pr_reg(pr_reg);
+        if (pr_reg)
+                core_scsi3_put_pr_reg(pr_reg);
         return ret;
 }
 
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index fa3cae393e13..77e6531fb0a1 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1074,23 +1074,36 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
         struct scatterlist *psg;
         void *paddr, *addr;
         unsigned int i, len, left;
+        unsigned int offset = sg_off;
 
         left = sectors * dev->prot_length;
 
         for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
+                unsigned int psg_len, copied = 0;
 
-                len = min(psg->length, left);
                 paddr = kmap_atomic(sg_page(psg)) + psg->offset;
-                addr = kmap_atomic(sg_page(sg)) + sg_off;
+                psg_len = min(left, psg->length);
+                while (psg_len) {
+                        len = min(psg_len, sg->length - offset);
+                        addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
 
-                if (read)
-                        memcpy(paddr, addr, len);
-                else
-                        memcpy(addr, paddr, len);
+                        if (read)
+                                memcpy(paddr + copied, addr, len);
+                        else
+                                memcpy(addr, paddr + copied, len);
 
-                left -= len;
+                        left -= len;
+                        offset += len;
+                        copied += len;
+                        psg_len -= len;
+
+                        if (offset >= sg->length) {
+                                sg = sg_next(sg);
+                                offset = 0;
+                        }
+                        kunmap_atomic(addr);
+                }
                 kunmap_atomic(paddr);
-                kunmap_atomic(addr);
         }
 }
 
@@ -1155,7 +1168,7 @@ sbc_dif_verify_read(struct se_cmd *cmd, sector_t start, unsigned int sectors,
 {
         struct se_device *dev = cmd->se_dev;
         struct se_dif_v1_tuple *sdt;
-        struct scatterlist *dsg;
+        struct scatterlist *dsg, *psg = sg;
         sector_t sector = start;
         void *daddr, *paddr;
         int i, j, offset = sg_off;
@@ -1163,14 +1176,14 @@ sbc_dif_verify_read(struct se_cmd *cmd, sector_t start, unsigned int sectors,
 
         for_each_sg(cmd->t_data_sg, dsg, cmd->t_data_nents, i) {
                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
-                paddr = kmap_atomic(sg_page(sg)) + sg->offset;
+                paddr = kmap_atomic(sg_page(psg)) + sg->offset;
 
                 for (j = 0; j < dsg->length; j += dev->dev_attrib.block_size) {
 
-                        if (offset >= sg->length) {
+                        if (offset >= psg->length) {
                                 kunmap_atomic(paddr);
-                                sg = sg_next(sg);
-                                paddr = kmap_atomic(sg_page(sg)) + sg->offset;
+                                psg = sg_next(psg);
+                                paddr = kmap_atomic(sg_page(psg)) + psg->offset;
                                 offset = 0;
                         }
 
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 43c5ca9878bc..3bebc71ea033 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -440,8 +440,8 @@ check_scsi_name:
                 padding = ((-scsi_target_len) & 3);
                 if (padding)
                         scsi_target_len += padding;
-                if (scsi_name_len > 256)
-                        scsi_name_len = 256;
+                if (scsi_target_len > 256)
+                        scsi_target_len = 256;
 
                 buf[off-1] = scsi_target_len;
                 off += scsi_target_len;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index c50fd9f11aab..2956250b7225 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -669,9 +669,6 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
                 return;
         }
 
-        if (!success)
-                cmd->transport_state |= CMD_T_FAILED;
-
         /*
          * Check for case where an explicit ABORT_TASK has been received
          * and transport_wait_for_tasks() will be waiting for completion..
@@ -681,7 +678,7 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                 complete(&cmd->t_transport_stop_comp);
                 return;
-        } else if (cmd->transport_state & CMD_T_FAILED) {
+        } else if (!success) {
                 INIT_WORK(&cmd->work, target_complete_failure_work);
         } else {
                 INIT_WORK(&cmd->work, target_complete_ok_work);
@@ -1604,6 +1601,9 @@ void transport_generic_request_failure(struct se_cmd *cmd,
         case TCM_CHECK_CONDITION_ABORT_CMD:
         case TCM_CHECK_CONDITION_UNIT_ATTENTION:
         case TCM_CHECK_CONDITION_NOT_READY:
+        case TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED:
+        case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
+        case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
                 break;
         case TCM_OUT_OF_RESOURCES:
                 sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;