linux/drivers/target, branch v3.3.7

target: Fix bug in handling of FILEIO + block_device resize ops

2012-05-21T17:46:21Z

commit cd9323fd68aee3c1c6b5b21e5746c9d1b586fb58 upstream. This patch fixes a bug in the handling of FILEIO w/ underlying block_device resize operations where the original fd_dev->fd_dev_size was incorrectly being used in fd_get_blocks() for READ_CAPACITY response payloads. This patch avoids using fd_dev->fd_dev_size for FILEIO devices with an underlying block_device, and instead changes fd_get_blocks() to get the sector count directly from i_size_read() as recommended by hch. Reported-by: Christoph Hellwig Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Fix SPC-2 RELEASE bug for multi-session iSCSI client setups

2012-05-21T17:46:21Z

commit edc318d9fea6854df752ec8c645b960b0d5a1d23 upstream. This patch addresses a bug in a special case for target core SPC-2 RELEASE logic where the same physical client (eg: iSCSI InitiatorName) with differing iSCSI session identifiers (ISID) is allowed to incorrectly release the same client's SPC-2 reservation from the non reservation holding path. Note this bug is specific to iscsi-target w/ SPC-2 reservations, and with the default enforce_pr_isids=1 device attr setting in target-core controls if a InitiatorName + different ISID reservations are handled the same as a single iSCSI client entity. Signed-off-by: Bernhard Kohl Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Drop incorrect se_lun_acl release for dynamic -> explict ACL conversion

2012-05-21T17:46:21Z

commit cfebf8f42f47327fa54cf05c19b98f4bd5236a26 upstream. This patch removes some potentially problematic legacy code within core_clear_initiator_node_from_tpg() that was originally intended to release left over se_lun_acl setup during dynamic NodeACL+MappedLUN generate when running with TPG demo-mode operation. Since we now only ever expect to allocate and release se_lun_acl from within target_core_fabric_configfs.c:target_fabric_make_mappedlun() and target_fabric_drop_mappedlun() context respectively, this code for demo-mode release is incorrect and needs to be removed. Cc: Christoph Hellwig Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

tcm_fc: Do not free tpg structure during wq allocation failure

2012-04-13T16:13:55Z

commit 06383f10c49f507220594a455c6491ca6f8c94ab upstream. Avoid freeing a registered tpg structure if an alloc_workqueue call fails. This fixes a bug where the failure was leaking memory associated with se_portal_group setup during the original core_tpg_register() call. Signed-off-by: Mark Rustad Acked-by: Kiran Patil Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

tcm_fc: Add abort flag for gracefully handling exchange timeout

2012-04-13T16:13:55Z

commit e1c4038282c7586c3544542b37872c434669d3ac upstream. Add abort flag and use it to terminate processing when an exchange is timed out or is reset. The abort flag is used in place of the transport_generic_free_cmd function call in the reset and timeout cases, because calling that function in that context would free memory that was in use. The aborted flag allows the lifetime to be managed in a more normal way, while truncating the processing. This change eliminates a source of memory corruption which manifested in a variety of ugly ways. (nab: Drop unused struct fc_exch *ep in ft_recv_seq) Signed-off-by: Mark Rustad Acked-by: Kiran Patil Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Fix 16-bit target ports for SET TARGET PORT GROUPS emulation

2012-04-02T17:32:06Z

commit 33395fb8a13731c7ef7b175dbf5a4d8a6738fe6c upstream. The old code did (MSB << 8) & 0xff, which always evaluates to 0. Just use get_unaligned_be16() so we don't have to worry about whether our open-coded version is correct or not. Signed-off-by: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: prevent NULL pointer dereference in target_report_luns

2012-04-02T17:32:02Z

commit 47f1b8803e1e358ebbf4f82bfdb98971c912a2c3 upstream. transport_kmap_data_sg can return NULL. I never saw this trigger, but returning -ENOMEM seems better than a crash. Also removes a pointless case while at it. Signed-off-by: Joern Engel Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: fix use after free in target_report_luns

2012-04-02T17:31:57Z

commit 382436f8804fe1cb20b9a2a811a10eb2d8554721 upstream. Fix possible NULL pointer dereference in target_report_luns failure path. Signed-off-by: Joern Engel Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Don't set WBUS16 or SYNC bits in INQUIRY response

2012-04-02T17:31:57Z

commit effc6cc8828257c32c37635e737f14fd6e19ecd7 upstream. SPC-4 says about the WBUS16 and SYNC bits: The meanings of these fields are specific to SPI-5 (see 6.4.3). For SCSI transport protocols other than the SCSI Parallel Interface, these fields are reserved. We don't have a SPI fabric module, so we should never set these bits. (The comment was misleading, since it only mentioned Sync but the actual code set WBUS16 too). Signed-off-by: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman

target: Set peripheral device type consistently in INQUIRY response

2012-04-02T17:31:56Z

commit 089461dda1770c10fea0b988ff74519a9be81d7e upstream. Current code sets the peripheral device type to 0x3f == "not present unknown" for virtual LUN 0 for standard INQUIRY commands, but leaves it as 0 == "connected direct access block" for VPD INQUIRY commands. This is just because the check for LUN 0 only happens in some code paths. Make our peripheral device type consistent by moving the LUN 0 check into the common emulate_inquiry() code. Signed-off-by: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman