user/sven/linux.git/drivers/target, branch v3.1.10

target/file: walk properly over sg list

2011-12-21T20:58:30Z

commit 9649fa1b8764f64c8cc4293e197e14cd46fe7205 upstream. This patch changes fileio to use for_each_sg() when walking se_task->task_sg memory passed into from loopback LLD struct scsi_cmnd scatterlist memory. This addresses an issue where FILEIO backends with loopback where hitting the following OOPs with mkfs.ext2: |kernel BUG at include/linux/scatterlist.h:97! |invalid opcode: 0000 [#1] PREEMPT SMP |Modules linked in: sd_mod tcm_loop target_core_stgt scsi_tgt target_core_pscsi target_core_file target_core_iblock target_core_mod configfs scsi_mod | |Pid: 671, comm: LIO_fileio Not tainted 3.1.0-rc10+ #139 Bochs Bochs |EIP: 0060:[] EFLAGS: 00010202 CPU: 0 |EIP is at fd_do_task+0x396/0x420 [target_core_file] | [] __transport_execute_tasks+0xd4/0x190 [target_core_mod] | [] transport_execute_tasks+0x3c/0xf0 [target_core_mod] |EIP: [] fd_do_task+0x396/0x420 [target_core_file] SS:ESP 0068:dea47e90 Signed-off-by: Sebastian Andrzej Siewior Cc: Christoph Hellwig Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

iscsi-target: Add missing F_BIT for iscsi_tm_rsp

2011-12-21T20:58:30Z

commit 7ae0b1038f9f7d4c91e9afd4dbbc98210bf1a241 upstream. This patch sets the missing ISCSI_FLAG_CMD_FINAL bit in iscsit_send_task_mgt_rsp() for a struct iscsi_tm_rsp PDU. This usage is hardcoded for all TM response PDUs in RFC-3720 section 10.6. Reported-by: whucecil Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Fix page length in emulated INQUIRY VPD page 86h

2011-12-21T20:58:30Z

commit 1289a0571c037b4757f60597d646aedb70361ec3 upstream. The LSB of the page length is at offset 3, not 2. Signed-off-by: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Handle 0 correctly in transport_get_sectors_6()

2011-12-21T20:58:29Z

commit 9b5cd7f37e1e018432111333e2a67f78ba41edfe upstream. SBC-3 says: A TRANSFER LENGTH field set to zero specifies that 256 logical blocks shall be written. Any other value specifies the number of logical blocks that shall be written. The old code was always just returning the value in the TRANSFER LENGTH byte. Fix this to return 256 if the byte is 0. Signed-off-by: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

iscsi-target: Fix residual count hanlding + remove iscsi_cmd->residual_count

2011-12-21T20:58:29Z

commit 7e46cf02687e40197ae07c623e660be2a2720064 upstream. This patch fixes iscsi-target handling of underflow where residual data is causing an OOPs by using the incorrect iscsi_cmd_t->data_length initially assigned in iscsit_allocate_se_cmd(). It resets iscsi_cmd_t->data_length from se_cmd_t->data_length after transport_generic_allocate_tasks() has been invoked in iscsit_handle_scsi_cmd() RX context, and converts iscsi_cmd->residual_count usage to access iscsi_cmd->se_cmd.residual_count to get the proper residual count set by target-core. Reported-by: Cc: Christoph Hellwig Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Reject SCSI data overflow for fabrics using transport_generic_map_mem_to_cmd

2011-12-21T20:58:28Z

commit fef58a6096770ed6ab49103a430cc755254a74d9 upstream. This patch changes transport_generic_map_mem_to_cmd() to reject SCSI data overflow and to send exception status with CHECK_CONDITION + TCM_INVALID_CDB_FIELD for fabrics that are passing a pre-populated struct scatterlist (eg: tcm_loop and iscsi-target) being mapped into se_cmd->t_data_sg and se_cmd->t_data_nents. This addresses an OOPs where transport_allocate_data_tasks() would walk the incorrect post OVERFLOW cmd->data_length value beyond the end of the passed scatterlist. Cc: Christoph Hellwig Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Fix wrong se_tmr being added to drain_tmr_list

2011-11-11T17:44:38Z

commit 6eb40b2af4908e9aee71e43e7a384243128c56dd upstream. This patch fixes another bug from LUN_RESET re-org fallout in core_tmr_drain_tmr_list() that was adding the wrong se_tmr_req into the local drain_tmr_list to be walked + released. Signed-off-by: Joern Engel Cc: Joern Engel Reviewed-by: Roland Dreier Cc: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Fix incorrect se_cmd assignment in core_tmr_drain_tmr_list

2011-11-11T17:44:38Z

commit 80ccbc8e00f7001d79dd503c2781487906b98611 upstream. This patch fixes a bug in core_tmr_drain_tmr_list() where drain_tmr_list was using the wrong se_tmr_req for cmd assignment due to a typo during the LUN_RESET re-org. This was resulting in general protection faults while using the leftover bogus *tmr_p pointer from list_for_each_entry_safe(). Signed-off-by: Joern Engel Cc: Joern Engel Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

iscsi-target: Fix non-immediate TMR handling

2011-11-11T17:44:19Z

commit 5a4c8666c6d576f076a7c6824589cdbb984c0f84 upstream. This patch addresses two issues with non immediate TMR handling in iscsit_handle_task_mgt_cmd(). The first involves breakage due to v3.1-rc conversion of iscsit_sequence_cmd(), which upon good status would hit the iscsit_add_reject_from_cmd() block of code. This patch adds an explict check for CMDSN_ERROR_CANNOT_RECOVER. The second adds a check to return when non immediate TMR operation is detected after iscsit_ack_from_expstatsn(), as iscsit_sequence_cmd() -> iscsit_execute_cmd() will have called transport_generic_handle_tmr() for the non immediate TMR case already. Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

iscsi-target: Add missing CMDSN_LOWER_THAN_EXP check in iscsit_handle_scsi_cmd

2011-11-11T17:44:18Z

commit 7e32da55e26b80d57961681e53aa67938268db3f upstream. This patch adds a missing CMDSN_LOWER_THAN_EXP return check for iscsit_sequence_cmd() in iscsit_handle_scsi_cmd() that was incorrectly dropped during the v3.1-rc cleanups to use iscsit_sequence_cmd(). Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman