From patchwork Tue Apr 2 19:58:05 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882265 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C433D1390 for ; Tue, 2 Apr 2019 19:58:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AF24828684 for ; Tue, 2 Apr 2019 19:58:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A34CD288D7; Tue, 2 Apr 2019 19:58:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 738DE28684 for ; Tue, 2 Apr 2019 19:58:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726337AbfDBT62 (ORCPT ); Tue, 2 Apr 2019 15:58:28 -0400 Received: from mail-pl1-f193.google.com ([209.85.214.193]:43602 "EHLO mail-pl1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT61 (ORCPT ); Tue, 2 Apr 2019 15:58:27 -0400 Received: by mail-pl1-f193.google.com with SMTP id m10so6787406plt.10 for ; Tue, 02 Apr 2019 12:58:27 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=zQEr3FfgZzvWxc5u7cOolA1w7b2W4VieB8Xp8U7mCfE=; b=OVtByl5rz21yTjCpwt+TqKsxVleDqcr2U+5hTc+oULKvlppi5kNVgupuXAyNkfzB5a HzeILibEiKU4+uy3fYxdi/PO5cB8hHyqfueQbLttUfGni7wqmSVOVDXw2Im32iflk5mC KusVM1vU7amDMg2gngvajReURxCicqcnlPS15d8gyXurMdmhaq3B38EVwChD5DVLKh0k wQpwYwXZKCp+8UMqMUNxooYrGnRZbvF/5o1SnQgYH91X9wpLbnPG1XbP0hHq6ntx5dtj HPgDMehtyQkA8XZBXbPaVwrSEQ276+BqEVpBAdZbH10FZ+cwPdwsSGSKGR5JsLgjOaef puHw== X-Gm-Message-State: APjAAAVgOfuUC9LQYZrZ5XVFhwDbxkjOz2Nsgftaj1+X6b/glzLdr4eB 0F3ea5TCy2i0Buks6TsZKwQ= X-Google-Smtp-Source: APXvYqzwAULeiO8iRKYEm5JM+DAUffJQjAvexsbOmFNmMVHapY/ZsOyetDjRtBtw9eO8xTNdxpeyiw== X-Received: by 2002:a17:902:361:: with SMTP id 88mr73128619pld.78.1554235107247; Tue, 02 Apr 2019 12:58:27 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:26 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 01/11] target/core: Fix a race condition in the LUN lookup code Date: Tue, 2 Apr 2019 12:58:05 -0700 Message-Id: <20190402195815.254796-2-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The rcu_dereference(deve->se_lun) expression occurs two times in the LUN lookup functions. Since these expressions are not serialized against deve->se_lun assignments each of these expressions may yield a different result. Avoid that the wrong LUN pointer is stored in se_cmd by reading deve->se_lun only once. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Fixes: 29a05deebf6c ("target: Convert se_node_acl->device_list[] to RCU hlist") # v4.10 Signed-off-by: Bart Van Assche --- drivers/target/target_core_device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c index 1f8482b6473b..7eae1c823c4e 100644 --- a/drivers/target/target_core_device.c +++ b/drivers/target/target_core_device.c @@ -85,7 +85,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun) goto out_unlock; } - se_cmd->se_lun = rcu_dereference(deve->se_lun); + se_cmd->se_lun = se_lun; se_cmd->pr_res_key = deve->pr_res_key; se_cmd->orig_fe_lun = unpacked_lun; se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; @@ -176,7 +176,7 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun) goto out_unlock; } - se_cmd->se_lun = rcu_dereference(deve->se_lun); + se_cmd->se_lun = se_lun; se_cmd->pr_res_key = deve->pr_res_key; se_cmd->orig_fe_lun = unpacked_lun; se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; From patchwork Tue Apr 2 19:58:06 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882267 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C5E111390 for ; Tue, 2 Apr 2019 19:58:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A5C5728684 for ; Tue, 2 Apr 2019 19:58:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 967FA288D3; Tue, 2 Apr 2019 19:58:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EE4012875F for ; Tue, 2 Apr 2019 19:58:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726352AbfDBT63 (ORCPT ); Tue, 2 Apr 2019 15:58:29 -0400 Received: from mail-pl1-f195.google.com ([209.85.214.195]:37841 "EHLO mail-pl1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT63 (ORCPT ); Tue, 2 Apr 2019 15:58:29 -0400 Received: by mail-pl1-f195.google.com with SMTP id w23so3848099ply.4 for ; Tue, 02 Apr 2019 12:58:28 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=N133rg5a0m02/y1a5R/nOMoMg4CIDO7f7/L3j02IvMo=; b=TEO3wqcn8E+IJRaZykUz7JCsR6/vZDDd/uaS93wMZfUT/DV2zQpBcLlBs95lqE30sN vRt0XmiWqMwN3Ti1TpvdJL6xL9nMKmb9LEzUeKqf0vkfUZbg3jSOx3pvjb5erwIqEGNg ODz144/3AEhg5FgtZA8XxHOgTyBltedDejx+b9wLzYcaaYSnHG0vpnkKrc9DQLpTbuK/ 2jUutPnsNPa6Dy9wHmxnfn/YgwdEH6Gc4kojt4qxvNLG5K4rl4NJI2JYeL02+Xzsy9ft SOmkaqaz1GpiR7lnmxGrF4oQLP27rGAAy7XoQcgdSrgPGaKuvXZPAL8aWwPHdEEiBAC2 nDQA== X-Gm-Message-State: APjAAAVO8N2YWdA0hFXAxDx9q/Y4B1POq0SbXdbvRBFbuMPE1IxAsmbW 7qCV4TiZBk2WGD2UJzwOnOc= X-Google-Smtp-Source: APXvYqxZPnls0NPQd7yx3G4Idw7kv2jDAPKwJKKn3IQRvRGCe8PkWrrG9yCerH3NuqI2T0ibgjZgEQ== X-Received: by 2002:a17:902:a607:: with SMTP id u7mr14635175plq.66.1554235108418; Tue, 02 Apr 2019 12:58:28 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:27 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 02/11] target/core: Rework the SPC-2 reservation handling code Date: Tue, 2 Apr 2019 12:58:06 -0700 Message-Id: <20190402195815.254796-3-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Instead of tracking the initiator that established an SPC-2 reservation, track the session through which the SPC-2 reservation has been established. This patch does not change any functionality. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/target_core_configfs.c | 5 ++-- drivers/target/target_core_pr.c | 33 +++++++++++++++------------ drivers/target/target_core_pr.h | 1 + drivers/target/target_core_tmr.c | 2 +- include/target/target_core_base.h | 4 ++-- include/target/target_core_fabric.h | 1 + 6 files changed, 27 insertions(+), 19 deletions(-) diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c index 3fe79875b3ac..db2558fe8d46 100644 --- a/drivers/target/target_core_configfs.c +++ b/drivers/target/target_core_configfs.c @@ -1624,11 +1624,12 @@ static ssize_t target_core_dev_pr_show_spc3_res(struct se_device *dev, static ssize_t target_core_dev_pr_show_spc2_res(struct se_device *dev, char *page) { + struct se_session *sess = dev->reservation_holder; struct se_node_acl *se_nacl; ssize_t len; - se_nacl = dev->dev_reserved_node_acl; - if (se_nacl) { + if (sess) { + se_nacl = sess->se_node_acl; len = sprintf(page, "SPC-2 Reservation: %s Initiator: %s\n", se_nacl->se_tpg->se_tpg_tfo->fabric_name, diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index 1597a9ebadca..03767693f580 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -111,10 +111,10 @@ target_scsi2_reservation_check(struct se_cmd *cmd) break; } - if (!dev->dev_reserved_node_acl || !sess) + if (!dev->reservation_holder || !sess) return 0; - if (dev->dev_reserved_node_acl != sess->se_node_acl) + if (dev->reservation_holder->se_node_acl != sess->se_node_acl) return TCM_RESERVATION_CONFLICT; if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS_WITH_ISID) { @@ -200,6 +200,16 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd) return 0; } +void target_release_reservation(struct se_device *dev) +{ + dev->reservation_holder = NULL; + dev->dev_reservation_flags &= ~DRF_SPC2_RESERVATIONS; + if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS_WITH_ISID) { + dev->dev_res_bin_isid = 0; + dev->dev_reservation_flags &= ~DRF_SPC2_RESERVATIONS_WITH_ISID; + } +} + sense_reason_t target_scsi2_reservation_release(struct se_cmd *cmd) { @@ -217,21 +227,16 @@ target_scsi2_reservation_release(struct se_cmd *cmd) return TCM_RESERVATION_CONFLICT; spin_lock(&dev->dev_reservation_lock); - if (!dev->dev_reserved_node_acl || !sess) + if (!dev->reservation_holder || !sess) goto out_unlock; - if (dev->dev_reserved_node_acl != sess->se_node_acl) + if (dev->reservation_holder->se_node_acl != sess->se_node_acl) goto out_unlock; if (dev->dev_res_bin_isid != sess->sess_bin_isid) goto out_unlock; - dev->dev_reserved_node_acl = NULL; - dev->dev_reservation_flags &= ~DRF_SPC2_RESERVATIONS; - if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS_WITH_ISID) { - dev->dev_res_bin_isid = 0; - dev->dev_reservation_flags &= ~DRF_SPC2_RESERVATIONS_WITH_ISID; - } + target_release_reservation(dev); tpg = sess->se_tpg; pr_debug("SCSI-2 Released reservation for %s LUN: %llu ->" " MAPPED LUN: %llu for %s\n", @@ -275,13 +280,13 @@ target_scsi2_reservation_reserve(struct se_cmd *cmd) tpg = sess->se_tpg; spin_lock(&dev->dev_reservation_lock); - if (dev->dev_reserved_node_acl && - (dev->dev_reserved_node_acl != sess->se_node_acl)) { + if (dev->reservation_holder && + dev->reservation_holder->se_node_acl != sess->se_node_acl) { pr_err("SCSI-2 RESERVATION CONFLIFT for %s fabric\n", tpg->se_tpg_tfo->fabric_name); pr_err("Original reserver LUN: %llu %s\n", cmd->se_lun->unpacked_lun, - dev->dev_reserved_node_acl->initiatorname); + dev->reservation_holder->se_node_acl->initiatorname); pr_err("Current attempt - LUN: %llu -> MAPPED LUN: %llu" " from %s \n", cmd->se_lun->unpacked_lun, cmd->orig_fe_lun, @@ -290,7 +295,7 @@ target_scsi2_reservation_reserve(struct se_cmd *cmd) goto out_unlock; } - dev->dev_reserved_node_acl = sess->se_node_acl; + dev->reservation_holder = sess; dev->dev_reservation_flags |= DRF_SPC2_RESERVATIONS; if (sess->sess_bin_isid != 0) { dev->dev_res_bin_isid = sess->sess_bin_isid; diff --git a/drivers/target/target_core_pr.h b/drivers/target/target_core_pr.h index 198fad5c89dc..a31c93e4e19c 100644 --- a/drivers/target/target_core_pr.h +++ b/drivers/target/target_core_pr.h @@ -58,6 +58,7 @@ extern struct kmem_cache *t10_pr_reg_cache; extern void core_pr_dump_initiator_port(struct t10_pr_registration *, char *, u32); +extern void target_release_reservation(struct se_device *dev); extern sense_reason_t target_scsi2_reservation_release(struct se_cmd *); extern sense_reason_t target_scsi2_reservation_reserve(struct se_cmd *); extern int core_scsi3_alloc_aptpl_registration( diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c index 3a1bb799a9ab..344df737f3a3 100644 --- a/drivers/target/target_core_tmr.c +++ b/drivers/target/target_core_tmr.c @@ -390,7 +390,7 @@ int core_tmr_lun_reset( if (!preempt_and_abort_list && (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS)) { spin_lock(&dev->dev_reservation_lock); - dev->dev_reserved_node_acl = NULL; + dev->reservation_holder = NULL; dev->dev_reservation_flags &= ~DRF_SPC2_RESERVATIONS; spin_unlock(&dev->dev_reservation_lock); pr_debug("LUN_RESET: SCSI-2 Released reservation\n"); diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h index 19a5bf4214fc..7c9716fe731e 100644 --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h @@ -795,8 +795,8 @@ struct se_device { spinlock_t se_tmr_lock; spinlock_t qf_cmd_lock; struct semaphore caw_sem; - /* Used for legacy SPC-2 reservationsa */ - struct se_node_acl *dev_reserved_node_acl; + /* Used for legacy SPC-2 reservations */ + struct se_session *reservation_holder; /* Used for ALUA Logical Unit Group membership */ struct t10_alua_lu_gp_member *dev_alua_lu_gp_mem; /* Used for SPC-3 Persistent Reservations */ diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h index 8ed90407f062..063f133e47c2 100644 --- a/include/target/target_core_fabric.h +++ b/include/target/target_core_fabric.h @@ -142,6 +142,7 @@ void transport_register_session(struct se_portal_group *, struct se_node_acl *, struct se_session *, void *); ssize_t target_show_dynamic_sessions(struct se_portal_group *, char *); void transport_free_session(struct se_session *); +void target_spc2_release(struct se_node_acl *nacl); void target_put_nacl(struct se_node_acl *); void transport_deregister_session_configfs(struct se_session *); void transport_deregister_session(struct se_session *); From patchwork Tue Apr 2 19:58:07 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882269 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 06FC21390 for ; Tue, 2 Apr 2019 19:58:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E501A28684 for ; Tue, 2 Apr 2019 19:58:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D8D61288D3; Tue, 2 Apr 2019 19:58:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6357128684 for ; Tue, 2 Apr 2019 19:58:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726372AbfDBT6b (ORCPT ); Tue, 2 Apr 2019 15:58:31 -0400 Received: from mail-pl1-f193.google.com ([209.85.214.193]:45247 "EHLO mail-pl1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6a (ORCPT ); Tue, 2 Apr 2019 15:58:30 -0400 Received: by mail-pl1-f193.google.com with SMTP id bf11so6775313plb.12 for ; Tue, 02 Apr 2019 12:58:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9LZpHuwewRP1ARYeGJ/sRqmTw/BjrwRVwTj1Sym1XJw=; b=blH3zjXCqvVBX8fTNbV6vl4YVehI8RlxqJBcCO50PA37nQnCkmpqgKL3nxyzwj+bv4 Ncxqtn8cfiVsz50oapWy8S7B1C5vkiKeJpmW8Y/hmkB8Za4qCOESX7bc17heHkbwYYqA 3NmTD2RTBO1JR2Z3USnq63g4gTgYFWMuFfDobHWQ6rHUyCRzQTSFhrrWXl/R9aS6spKA YymbHI4d8p2XoAlhD1wVOE9tQ5r4mi2nLlzjd8Sdb0tyHpJhAUqYN+KzztePY/iRE54v xF6TjHf0gSlRKmdFwl98xm0/P07HM7tLFkK5r1n4zCYUnex30W/1Qrie3tZbxFp+uU3T C5MQ== X-Gm-Message-State: APjAAAXNiNf96TyRclSs11quZdUDqdTrA+pEIz1/nCcPOzxniUvyq8k5 PGGs/WwSvzAGSoukym6892Y= X-Google-Smtp-Source: APXvYqwQpcL73HIDQ9096LXbyHxIG+CHkLKWxPGDzpLtfLIPcvtqQtsLGDn8bcBuWqf2+TKOkCxV5A== X-Received: by 2002:a17:902:12f:: with SMTP id 44mr72755709plb.208.1554235110112; Tue, 02 Apr 2019 12:58:30 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:29 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 03/11] target/core: Release SPC-2 reservation upon initiator logout Date: Tue, 2 Apr 2019 12:58:07 -0700 Message-Id: <20190402195815.254796-4-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP While testing with the libiscsi tool I noticed after the tool had stopped and hence after it had logged out that an SPC-2 reservation was still active: $ (cd /sys/kernel/config/target/core && find -name res_holder|xargs grep -aH .) ./pscsi_0/vdev3/pr/res_holder:Passthrough ./iblock_0/vdev2/pr/res_holder:No SPC-3 Reservation holder ./fileio_1/vdev1/pr/res_holder:SPC-2 Reservation: iSCSI Initiator: iqn.2007-10.com.github:sahlberg:libiscsi:iscsi-test-2 ./fileio_0/vdev0/pr/res_holder:No SPC-3 Reservation holder This is a bug. SPC-2 reservations must be cleared when an initiator logs out. This patch fixes that bug. A quote from SPC-2 illustrates this: "Reservations managed using the reserve/release method do not persist across some recovery actions (e.g., hard resets). When a target performs one of these recovery actions, the application client(s) have to rediscover the configuration and re-establish the required reservations." Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/target_core_transport.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index e3f7e21e6614..93ef5c6362d6 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -550,6 +550,15 @@ void transport_deregister_session_configfs(struct se_session *se_sess) } EXPORT_SYMBOL(transport_deregister_session_configfs); +static int target_sess_release_reservation(struct se_device *dev, void *data) +{ + struct se_session *sess = data; + + if (dev->reservation_holder == sess) + target_release_reservation(dev); + return 0; +} + void transport_free_session(struct se_session *se_sess) { struct se_node_acl *se_nacl = se_sess->se_node_acl; @@ -592,6 +601,7 @@ void transport_free_session(struct se_session *se_sess) sbitmap_queue_free(&se_sess->sess_tag_pool); kvfree(se_sess->sess_cmd_map); } + target_for_each_device(target_sess_release_reservation, se_sess); percpu_ref_exit(&se_sess->cmd_count); kmem_cache_free(se_sess_cache, se_sess); } From patchwork Tue Apr 2 19:58:08 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882271 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 82033139A for ; Tue, 2 Apr 2019 19:58:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6C2B22875F for ; Tue, 2 Apr 2019 19:58:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 604D1288D7; Tue, 2 Apr 2019 19:58:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 082BA288D3 for ; Tue, 2 Apr 2019 19:58:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726384AbfDBT6c (ORCPT ); Tue, 2 Apr 2019 15:58:32 -0400 Received: from mail-pl1-f196.google.com ([209.85.214.196]:42060 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6c (ORCPT ); Tue, 2 Apr 2019 15:58:32 -0400 Received: by mail-pl1-f196.google.com with SMTP id cv12so6789414plb.9 for ; Tue, 02 Apr 2019 12:58:32 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Sc/tDFFX599Yj5eKYbgNuAMSFnZm3pcl+ODaixMtr3k=; b=qm8SN08rXO6XoKaLIxZzUDMYlZHM27fcrlCtajF9+vjqIFg/V+x9PU8Wiz3Rte9lsp /jI2enjF3pCVFS3zMdGUsA4qaSyJmkwLfxkyM/6URB9bGJwxATA43qa0wuU8coLCIBeD Lfc8Do8rMvzhk5ZQL5twYTOplvlhGQSHDJt9e9xHA1FZ0pRbx52ZQLizaFIhX3W/HAw9 /lSB8MN+Z2I8UZR5Caoozq3GeXWmJLz+yoAcOc8LIRqAfoWZS3Lj30l08xeyEPJD/gX/ HoOCsJL05o0lECOPuJua28Uht9T1LK+sNQUeWSOU4IMwoO3Ba4HRUrC/j95ypb1iFpje OweQ== X-Gm-Message-State: APjAAAVcnvVF6wzwrbehL694OhOC237CHPvc410c66Ax4y84X8OmPmfj QV6LxdAPdeQ0lPKKiPp3h8kaDRjOmEI= X-Google-Smtp-Source: APXvYqwvqXtF09LSIrxI3erDE3KCZCzLh+QX64WUcpZmsSurkuiqdwMZuClZf3BGCXZDaM9XKXltOQ== X-Received: by 2002:a17:902:aa91:: with SMTP id d17mr7755473plr.43.1554235111684; Tue, 02 Apr 2019 12:58:31 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:30 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 04/11] target/core: Remove a set-but-not-used member variable from the XCOPY implementation Date: Tue, 2 Apr 2019 12:58:08 -0700 Message-Id: <20190402195815.254796-5-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch does not change any functionality. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/target_core_xcopy.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c index 9be1418e919f..d97be766e4ac 100644 --- a/drivers/target/target_core_xcopy.c +++ b/drivers/target/target_core_xcopy.c @@ -389,7 +389,6 @@ static int target_xcopy_parse_segment_descriptors(struct se_cmd *se_cmd, */ struct xcopy_pt_cmd { - bool remote_port; struct se_cmd se_cmd; struct completion xpt_passthrough_sem; unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER]; @@ -520,9 +519,7 @@ static void target_xcopy_setup_pt_port( * when CDB is received on local source port, and READs blocks to * WRITE on remote destination port. */ - if (remote_port) { - xpt_cmd->remote_port = remote_port; - } else { + if (!remote_port) { pt_cmd->se_lun = ec_cmd->se_lun; pt_cmd->se_dev = ec_cmd->se_dev; @@ -539,9 +536,7 @@ static void target_xcopy_setup_pt_port( * blocks from the remote source port to WRITE on local * destination port. */ - if (remote_port) { - xpt_cmd->remote_port = remote_port; - } else { + if (!remote_port) { pt_cmd->se_lun = ec_cmd->se_lun; pt_cmd->se_dev = ec_cmd->se_dev; From patchwork Tue Apr 2 19:58:09 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882273 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0F1C4139A for ; Tue, 2 Apr 2019 19:58:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EE08A28684 for ; Tue, 2 Apr 2019 19:58:34 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E2261288D3; Tue, 2 Apr 2019 19:58:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8240628684 for ; Tue, 2 Apr 2019 19:58:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726387AbfDBT6e (ORCPT ); Tue, 2 Apr 2019 15:58:34 -0400 Received: from mail-pf1-f193.google.com ([209.85.210.193]:40229 "EHLO mail-pf1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6e (ORCPT ); Tue, 2 Apr 2019 15:58:34 -0400 Received: by mail-pf1-f193.google.com with SMTP id c207so6905040pfc.7 for ; Tue, 02 Apr 2019 12:58:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=hBdkMvkWPMw9/dUvhoDzAModGoXJep4CKFG3+lUxvEw=; b=WPXapofJhdnTZAI6kvwoXSgbf3yW0hsj0clxnqmeig5to4/U0lY+lNTeLk1q192CBL diEjQHRhPWFh4AVwNHFZ068C9L3CfjzwGizBve7EFbXYrckMBY8kBSh4+tGkuerxm8ts mm2hCmGQBY4n7byn5ALQvobqN7VNuxQY2sRjFtmJuolJpFoYICBa7PUuQFNQNSMxv7YF bGfZLEJJLapbjgJTJbRvlcw8PcTeRfTJ81oHb1kRue4GBoTAe2RFxRB70Gx9KTrkfKB1 UIoY1n9NXQHduOoCdAanOk4haFlrHrD2z//C84Hnje+6ko1WJXPcDUweFMUTXK46+BqC 1lfQ== X-Gm-Message-State: APjAAAXLUxsgdn2xH++Ao56k8fXUzHxg7wxaKOHb4GzdLUaAar7UoElr L1CQBYsERlpPo/Qld8Gu80I= X-Google-Smtp-Source: APXvYqxYiLTdmtcGi1+kmRlr867cwcMDP1lWp2P+OEWIB8wRx3z5Pw9fuDvdVMQFAX9h7S0MVsDb8A== X-Received: by 2002:a63:e045:: with SMTP id n5mr27932816pgj.230.1554235112996; Tue, 02 Apr 2019 12:58:32 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:32 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 05/11] target/core: Simplify LUN initialization in XCOPY implementation Date: Tue, 2 Apr 2019 12:58:09 -0700 Message-Id: <20190402195815.254796-6-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Other than removing a few pr_debug() statements, this patch does not change any functionality. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/target_core_xcopy.c | 43 +++--------------------------- 1 file changed, 3 insertions(+), 40 deletions(-) diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c index d97be766e4ac..39f4490a3ebe 100644 --- a/drivers/target/target_core_xcopy.c +++ b/drivers/target/target_core_xcopy.c @@ -513,53 +513,16 @@ static void target_xcopy_setup_pt_port( struct se_cmd *ec_cmd = xop->xop_se_cmd; struct se_cmd *pt_cmd = &xpt_cmd->se_cmd; - if (xop->op_origin == XCOL_SOURCE_RECV_OP) { - /* - * Honor destination port reservations for X-COPY PUSH emulation - * when CDB is received on local source port, and READs blocks to - * WRITE on remote destination port. - */ - if (!remote_port) { - pt_cmd->se_lun = ec_cmd->se_lun; - pt_cmd->se_dev = ec_cmd->se_dev; - - pr_debug("Honoring local SRC port from ec_cmd->se_dev:" - " %p\n", pt_cmd->se_dev); - pt_cmd->se_lun = ec_cmd->se_lun; - pr_debug("Honoring local SRC port from ec_cmd->se_lun: %p\n", - pt_cmd->se_lun); - } - } else { - /* - * Honor source port reservation for X-COPY PULL emulation - * when CDB is received on local desintation port, and READs - * blocks from the remote source port to WRITE on local - * destination port. - */ - if (!remote_port) { - pt_cmd->se_lun = ec_cmd->se_lun; - pt_cmd->se_dev = ec_cmd->se_dev; - - pr_debug("Honoring local DST port from ec_cmd->se_dev:" - " %p\n", pt_cmd->se_dev); - pt_cmd->se_lun = ec_cmd->se_lun; - pr_debug("Honoring local DST port from ec_cmd->se_lun: %p\n", - pt_cmd->se_lun); - } + if (!remote_port) { + pt_cmd->se_lun = ec_cmd->se_lun; + pt_cmd->se_dev = ec_cmd->se_dev; } } static void target_xcopy_init_pt_lun(struct se_device *se_dev, struct se_cmd *pt_cmd, bool remote_port) { - /* - * Don't allocate + init an pt_cmd->se_lun if honoring local port for - * reservations. The pt_cmd->se_lun pointer will be setup from within - * target_xcopy_setup_pt_port() - */ if (remote_port) { - pr_debug("Setup emulated se_dev: %p from se_dev\n", - pt_cmd->se_dev); pt_cmd->se_lun = &se_dev->xcopy_lun; pt_cmd->se_dev = se_dev; } From patchwork Tue Apr 2 19:58:10 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882275 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E68C51390 for ; Tue, 2 Apr 2019 19:58:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CE50428684 for ; Tue, 2 Apr 2019 19:58:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C2DBD288D3; Tue, 2 Apr 2019 19:58:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5A1BE28684 for ; Tue, 2 Apr 2019 19:58:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726388AbfDBT6f (ORCPT ); Tue, 2 Apr 2019 15:58:35 -0400 Received: from mail-pl1-f193.google.com ([209.85.214.193]:44937 "EHLO mail-pl1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6e (ORCPT ); Tue, 2 Apr 2019 15:58:34 -0400 Received: by mail-pl1-f193.google.com with SMTP id g12so6788016pll.11 for ; Tue, 02 Apr 2019 12:58:34 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=aXFMCKAoJOVo35rShfjE4fTzJl3FLBjaEbdvLdiRl8Q=; b=MhLg706VaFED4hyFc/oOoaX/rTlLpTxkJIUJ8//fE6YDeXeCdhFCY/CBK+xvLVRcCx DZEIr7NIGN1J6n/oFcZrrWCow3mSmMheIzPJl4ZfLyaCxRFZK2glfa7uwgZiTjiWaD4X nOjHgy58pd6WS7FLMY1VNZOUlbiXTVnU9Kv8afTy1IgH75fpztf0Alnxd7MOauiNooFQ t1KFzFPPWXWevCox8enLLM6dhN6jBgD4JEboiWDXE8CnO4JraP8qW3+5M2DpsQU+out/ DP5CTAy0OZBpZFN6zpA6N1LOW+KylpTY5cGM9cCVs0ge4ag15nu9QtAP2D4wRZAxKyqS 9v6Q== X-Gm-Message-State: APjAAAWwAEVHedonbSYhFabVLbAXDWK6929cK77oeqwSJe+70HqyOZZX l1chIhjehQ9AjbhbM2Q4qBA= X-Google-Smtp-Source: APXvYqzn2JElr/DTUAyb86UvMiEsmwhNSqwBT0Sgtz+XlMz9fsFKNHLC3qioxmkUdFYRXwqj8IIzHw== X-Received: by 2002:a17:902:1003:: with SMTP id b3mr73035870pla.306.1554235114100; Tue, 02 Apr 2019 12:58:34 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:33 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 06/11] target/core: Make the XCOPY setup code easier to read by inlining two functions Date: Tue, 2 Apr 2019 12:58:10 -0700 Message-Id: <20190402195815.254796-7-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The target_xcopy_setup_pt_port() and target_xcopy_init_pt_lun() functions obfuscate what is really going on. Hence inline these two functions. This patch does not change any functionality. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/target_core_xcopy.c | 50 ++++++++++++++---------------- 1 file changed, 23 insertions(+), 27 deletions(-) diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c index 39f4490a3ebe..e59a896ac58a 100644 --- a/drivers/target/target_core_xcopy.c +++ b/drivers/target/target_core_xcopy.c @@ -505,31 +505,20 @@ void target_xcopy_release_pt(void) destroy_workqueue(xcopy_wq); } -static void target_xcopy_setup_pt_port( - struct xcopy_pt_cmd *xpt_cmd, - struct xcopy_op *xop, - bool remote_port) -{ - struct se_cmd *ec_cmd = xop->xop_se_cmd; - struct se_cmd *pt_cmd = &xpt_cmd->se_cmd; - - if (!remote_port) { - pt_cmd->se_lun = ec_cmd->se_lun; - pt_cmd->se_dev = ec_cmd->se_dev; - } -} - -static void target_xcopy_init_pt_lun(struct se_device *se_dev, - struct se_cmd *pt_cmd, bool remote_port) -{ - if (remote_port) { - pt_cmd->se_lun = &se_dev->xcopy_lun; - pt_cmd->se_dev = se_dev; - } - - pt_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; -} - +/* + * target_xcopy_setup_pt_cmd - set up a pass-through command + * @xpt_cmd: Data structure to initialize. + * @xop: Describes the XCOPY operation received from an initiator. + * @se_dev: Backend device to associate with @xpt_cmd if + * @remote_port == true. + * @cdb: SCSI CDB to be copied into @xpt_cmd. + * @remote_port: If false, use the LUN through which the XCOPY command has + * been received. If true, use @se_dev->xcopy_lun. + * @alloc_mem: Whether or not to allocate an SGL list. + * + * Set up a SCSI command (READ or WRITE) that will be used to execute an + * XCOPY command. + */ static int target_xcopy_setup_pt_cmd( struct xcopy_pt_cmd *xpt_cmd, struct xcopy_op *xop, @@ -541,12 +530,19 @@ static int target_xcopy_setup_pt_cmd( struct se_cmd *cmd = &xpt_cmd->se_cmd; sense_reason_t sense_rc; int ret = 0, rc; + /* * Setup LUN+port to honor reservations based upon xop->op_origin for * X-COPY PUSH or X-COPY PULL based upon where the CDB was received. */ - target_xcopy_init_pt_lun(se_dev, cmd, remote_port); - target_xcopy_setup_pt_port(xpt_cmd, xop, remote_port); + if (remote_port) { + cmd->se_lun = &se_dev->xcopy_lun; + cmd->se_dev = se_dev; + } else { + cmd->se_lun = xop->xop_se_cmd->se_lun; + cmd->se_dev = xop->xop_se_cmd->se_dev; + } + cmd->se_cmd_flags |= SCF_SE_LUN_CMD; cmd->tag = 0; sense_rc = target_setup_cmd_from_cdb(cmd, cdb); From patchwork Tue Apr 2 19:58:11 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882277 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B50D2139A for ; Tue, 2 Apr 2019 19:58:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9FABD2875F for ; Tue, 2 Apr 2019 19:58:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 94571288D7; Tue, 2 Apr 2019 19:58:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3D1F12875F for ; Tue, 2 Apr 2019 19:58:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726396AbfDBT6g (ORCPT ); Tue, 2 Apr 2019 15:58:36 -0400 Received: from mail-pg1-f196.google.com ([209.85.215.196]:39088 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6g (ORCPT ); Tue, 2 Apr 2019 15:58:36 -0400 Received: by mail-pg1-f196.google.com with SMTP id k3so7079001pga.6 for ; Tue, 02 Apr 2019 12:58:36 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=o/1TOsKw9dGiw9Lvusb7zBcwbGG0jQBnLmV36q+mCqk=; b=T79Pi0WVlDvcoDQ89nYWcaU7oAjelKlpdgOzJYHIPVLvQwynUKoEeVMGCAhiqpVSJo RkgkTiiXbJOzsQ/FYXo28Ltt1V3gDiNkupDZla9RCUv6mISeZoQfaS581rONMzo++B5d of9BpL15cEOYjakQyMO0WhwubkIZza0JEr5bdRTmQsJqdSiYlNbypQzsovhRKwM1HbUr voHk09GPuJA2L2KO0TRnER6uYjFZ4xqCYKVMqRnlh9OfYObmWp7P+CnFJ9aw+rOVDLPv 5lR5QB180SkvtStaBDMB6Ds0HHFYoJBkJ6466YOvKLzzlgfi7/WZtG35mqKHHhlziMVn Aodg== X-Gm-Message-State: APjAAAW7rMoWKr7Xg9PxMXg9ZuyWLvgRO5IuV7cwiDfoeS3kcyR1o4sr tIwYRbj4ASd2S+josEeqKLc= X-Google-Smtp-Source: APXvYqzwNfaWapmprMO3p0frps3AFlR3ieWkoxjJDs8/LLDdKHbxW7SVt6GvNT9WDlK9PyRiMWx3Wg== X-Received: by 2002:a63:7e10:: with SMTP id z16mr15280604pgc.40.1554235115873; Tue, 02 Apr 2019 12:58:35 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:34 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 07/11] target/iscsi: Detect conn_cmd_list corruption early Date: Tue, 2 Apr 2019 12:58:11 -0700 Message-Id: <20190402195815.254796-8-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Certain behavior of an initiator can cause the target driver to send both a reject and a SCSI response. If that happens two target_put_sess_cmd() calls will occur without the command having been removed from conn_cmd_list. In other words, conn_cmd_list will get corrupted once the freed memory is reused. Although the Linux kernel can detect list corruption if list debugging is enabled, in this case the context in which list corruption is detected is not related to the context that caused list corruption. Hence add WARN_ON() statements that report the context that is causing list corruption. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/iscsi/iscsi_target_util.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c index 3ac494f63a0b..3da062ccd2ab 100644 --- a/drivers/target/iscsi/iscsi_target_util.c +++ b/drivers/target/iscsi/iscsi_target_util.c @@ -769,6 +769,8 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown) struct se_cmd *se_cmd = cmd->se_cmd.se_tfo ? &cmd->se_cmd : NULL; int rc; + WARN_ON(!list_empty(&cmd->i_conn_node)); + __iscsit_free_cmd(cmd, shutdown); if (se_cmd) { rc = transport_generic_free_cmd(se_cmd, shutdown); From patchwork Tue Apr 2 19:58:12 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882279 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 122CE139A for ; Tue, 2 Apr 2019 19:58:39 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F03A22875F for ; Tue, 2 Apr 2019 19:58:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E462F288D7; Tue, 2 Apr 2019 19:58:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 81C392875F for ; Tue, 2 Apr 2019 19:58:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726399AbfDBT6i (ORCPT ); Tue, 2 Apr 2019 15:58:38 -0400 Received: from mail-pg1-f196.google.com ([209.85.215.196]:36506 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6i (ORCPT ); Tue, 2 Apr 2019 15:58:38 -0400 Received: by mail-pg1-f196.google.com with SMTP id 85so7086624pgc.3 for ; Tue, 02 Apr 2019 12:58:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=xbUWwWu9HBJ8Pwz1lj3z2Zy0bcYkUyecgACjBL+avEA=; b=n3Mr1akW/LFoMGkRQBAHBtWF+OKmn8JuBH8X0zH4bCesalxWg9nDRxMSdTQ5yCMMc8 uZzg0lkFHcixp0v1mL9qmYXh0V9QyyPkMKeCXtaD+fGvS1ZfTIhrabpnhoD3IUJYfCIF 6cAlLgzbqV04sV/G/kUvfnY8BxjWuPvX670DsIr6Tax3DwtfgnEdpd4ll5eTViHr/EmR 5ePb4QfXjdBP45g/L6rsSW+1BFqM7PAM5uYOIfJxDSOtN8Xafrj1xXoOg+p2bKyu6evB GfqqVcMB8kUsJnEyaFSGDV2G+ipPc+Hf5d7N4QuAHKo9UlfwkQdnMecoQUtOFspO9eHD eS7A== X-Gm-Message-State: APjAAAXyUCsuChFmlChMxF6/LKCMtgFlS4n+L4UR81sGNKPqKTpS+3hZ 0AfLzuE0qoY1O/lfeJPmrU8= X-Google-Smtp-Source: APXvYqx4AB/z/T4NeZgl19x/cx7G3JFVKV/NWBPsqWNY3SrEeAGO46AIEbT+mTGxXXidmUhGrRNEFA== X-Received: by 2002:a63:e10b:: with SMTP id z11mr64509946pgh.46.1554235117226; Tue, 02 Apr 2019 12:58:37 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:36 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 08/11] target/iscsi: Only send R2T if needed Date: Tue, 2 Apr 2019 12:58:12 -0700 Message-Id: <20190402195815.254796-9-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If an initiator submits more immediate data than the size derived from the SCSI CDB, do not send any R2T to the initiator. This scenario is triggered by the libiscsi test ALL.iSCSIResiduals.WriteVerify16Residuals if the iSCSI target driver is modified to discard too large immediate data buffers instead of trying to parse these as an iSCSI PDU. This patch avoids that a negative xfer_len value is passed to iscsit_add_r2t_to_list() if too large immediate data buffers are handled correctly. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/iscsi/iscsi_target.c | 6 ++++++ drivers/target/iscsi/iscsi_target_util.c | 2 ++ 2 files changed, 8 insertions(+) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 5ce6e2a40e00..828697015759 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -3121,6 +3121,12 @@ int iscsit_build_r2ts_for_cmd( else xfer_len = conn->sess->sess_ops->MaxBurstLength; } + + if ((s32)xfer_len < 0) { + cmd->cmd_flags |= ICF_SENT_LAST_R2T; + break; + } + cmd->r2t_offset += xfer_len; if (cmd->r2t_offset == cmd->se_cmd.data_length) diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c index 3da062ccd2ab..5b26bc23016a 100644 --- a/drivers/target/iscsi/iscsi_target_util.c +++ b/drivers/target/iscsi/iscsi_target_util.c @@ -67,6 +67,8 @@ int iscsit_add_r2t_to_list( lockdep_assert_held(&cmd->r2t_lock); + WARN_ON_ONCE((s32)xfer_len < 0); + r2t = kmem_cache_zalloc(lio_r2t_cache, GFP_ATOMIC); if (!r2t) { pr_err("Unable to allocate memory for struct iscsi_r2t.\n"); From patchwork Tue Apr 2 19:58:13 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882281 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 580F41390 for ; Tue, 2 Apr 2019 19:58:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3FB762875F for ; Tue, 2 Apr 2019 19:58:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 34037288D7; Tue, 2 Apr 2019 19:58:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B4D832875F for ; Tue, 2 Apr 2019 19:58:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726404AbfDBT6j (ORCPT ); Tue, 2 Apr 2019 15:58:39 -0400 Received: from mail-pg1-f194.google.com ([209.85.215.194]:46611 "EHLO mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6j (ORCPT ); Tue, 2 Apr 2019 15:58:39 -0400 Received: by mail-pg1-f194.google.com with SMTP id q1so7065791pgv.13 for ; Tue, 02 Apr 2019 12:58:38 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=tCv0ipwA2XFoVNNQ1rbUjPSAYhv7VvseaH6qCNAJ8hQ=; b=TxPpkjs5Z0OSEkTSPdp+TC8YyqHrY0j0F1kDDepnt3kJ/42DKxan/dAfouJUDROJbX PdjPMtT+SUzgZDkadx0/Twiu0LZM05irSAof34I5QJi4Wvp1B63WBNH6bafxr1zt4R+2 4Q2sdz+EyhnyHFCWm83ML5gygXF75Ug4/5i1WVINFShB3is5xpYCYWAG1YTDlTW8+CWR R46ouFTY/eHWo6vQflc/TQE9xR7clHYkRQPBg3npGlNQ1kBcDFCLmBn8iqng2ZJJsGTK AHKPIe2E/NHhnMwfiygF4lIBNnWCTNmEmydXawhnkJ5/h7Tc0Lpvvh/r6VIJJaSg+usp KPng== X-Gm-Message-State: APjAAAV75HAZIAv/WANupSSNDDctZlT82dvWlh9/p8LYMbCdzspC9fW5 sRggBGuSafTqp1DGXLrrUIQ= X-Google-Smtp-Source: APXvYqzrVaPKsxMQw1zqRWrcbqwIq+Neumvbu4aUcoiwq6gJkPjhwirsx088EV+9j4Om58QHJlUGcg== X-Received: by 2002:a63:170d:: with SMTP id x13mr65435752pgl.169.1554235118415; Tue, 02 Apr 2019 12:58:38 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:37 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 09/11] target/iscsi: Handle too large immediate data buffers correctly Date: Tue, 2 Apr 2019 12:58:13 -0700 Message-Id: <20190402195815.254796-10-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Since target_alloc_sgl() and iscsit_allocate_iovecs() allocate buffer space for se_cmd.data_length bytes and since that number can be smaller than the iSCSI Expected Data Transfer Length (EDTL), ensure that the iSCSI target driver does not attempt to receive more bytes than what fits in the receive buffer. Always receive the full immediate data buffer such that the iSCSI target driver does not attempt to parse immediate data as an iSCSI PDU. Note: the current code base only calls iscsit_get_dataout() if the size of the immediate data buffer does not exceed the buffer size derived from the SCSI CDB. See also target_cmd_size_check(). Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/iscsi/iscsi_target.c | 27 +++++++++++++++++++++--- drivers/target/iscsi/iscsi_target_util.c | 1 + include/target/iscsi/iscsi_target_core.h | 1 + 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 828697015759..8cdea25f1377 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -1568,9 +1568,11 @@ iscsit_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, { struct kvec *iov; u32 checksum, iov_count = 0, padding = 0, rx_got = 0, rx_size = 0; - u32 payload_length = ntoh24(hdr->dlength); + u32 payload_length; int iov_ret, data_crc_failed = 0; + payload_length = min_t(u32, cmd->se_cmd.data_length, + ntoh24(hdr->dlength)); rx_size += payload_length; iov = &cmd->iov_data[0]; @@ -2575,14 +2577,33 @@ static int iscsit_handle_immediate_data( u32 checksum, iov_count = 0, padding = 0; struct iscsi_conn *conn = cmd->conn; struct kvec *iov; + void *overflow_buf = NULL; - iov_ret = iscsit_map_iovec(cmd, cmd->iov_data, cmd->write_data_done, length); + BUG_ON(cmd->write_data_done > cmd->se_cmd.data_length); + rx_size = min(cmd->se_cmd.data_length - cmd->write_data_done, length); + iov_ret = iscsit_map_iovec(cmd, cmd->iov_data, cmd->write_data_done, + rx_size); if (iov_ret < 0) return IMMEDIATE_DATA_CANNOT_RECOVER; - rx_size = length; iov_count = iov_ret; iov = &cmd->iov_data[0]; + if (rx_size < length) { + /* + * Special case: length of immediate data exceeds the data + * buffer size derived from the CDB. + */ + overflow_buf = kmalloc(length - rx_size, GFP_KERNEL); + if (!overflow_buf) { + iscsit_unmap_iovec(cmd); + return IMMEDIATE_DATA_CANNOT_RECOVER; + } + cmd->overflow_buf = overflow_buf; + iov[iov_count].iov_base = overflow_buf; + iov[iov_count].iov_len = length - rx_size; + iov_count++; + rx_size = length; + } padding = ((-length) & 3); if (padding != 0) { diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c index 5b26bc23016a..fae85bfd790e 100644 --- a/drivers/target/iscsi/iscsi_target_util.c +++ b/drivers/target/iscsi/iscsi_target_util.c @@ -737,6 +737,7 @@ void iscsit_release_cmd(struct iscsi_cmd *cmd) kfree(cmd->pdu_list); kfree(cmd->seq_list); kfree(cmd->tmr_req); + kfree(cmd->overflow_buf); kfree(cmd->iov_data); kfree(cmd->text_in_ptr); diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h index 24c398f4a68f..a49d37140a64 100644 --- a/include/target/iscsi/iscsi_target_core.h +++ b/include/target/iscsi/iscsi_target_core.h @@ -473,6 +473,7 @@ struct iscsi_cmd { struct timer_list dataout_timer; /* Iovecs for SCSI data payload RX/TX w/ kernel level sockets */ struct kvec *iov_data; + void *overflow_buf; /* Iovecs for miscellaneous purposes */ #define ISCSI_MISC_IOVECS 5 struct kvec iov_misc[ISCSI_MISC_IOVECS]; From patchwork Tue Apr 2 19:58:14 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882283 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B5347139A for ; Tue, 2 Apr 2019 19:58:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E74A288D3 for ; Tue, 2 Apr 2019 19:58:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 924012875F; Tue, 2 Apr 2019 19:58:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 093F52875F for ; Tue, 2 Apr 2019 19:58:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726409AbfDBT6k (ORCPT ); Tue, 2 Apr 2019 15:58:40 -0400 Received: from mail-pf1-f196.google.com ([209.85.210.196]:45063 "EHLO mail-pf1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6k (ORCPT ); Tue, 2 Apr 2019 15:58:40 -0400 Received: by mail-pf1-f196.google.com with SMTP id e24so6885678pfi.12 for ; Tue, 02 Apr 2019 12:58:39 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=VVji9CJyD/6o3nbWs+5YCM4G3d+njT/hnFGXqCt+V/s=; b=FL5Mr/EnQ3/G0f+xVug6OwmZJLs2pM0t0CsmxeZ4+F4KtVH+V/OLPT11uaBaimwvPb Z95cMStWMG7C0EJsCmqfb4Tz5B0Gris7JcudmUKhznfxbiO/OOyuIDOoe3FydZanBubA LT2X9sfekcgDOB8DyiWuLDj88tDUsRzhKiNub6WGA4FfhbOtzWeJbrCBasMZK7EYaZYr gJ6gtDYC0SD/dkmIiwr9E2FrDnKbgTXD6jeTBfObvPn4miVSszQ8V0r22nnZx7psI17+ LXXXb28wxmWf9+9OzbARAHMJBnfAame+YWn/RR/mYAnjliSQvh40EFl6kpaRv9MLWXR4 0mSA== X-Gm-Message-State: APjAAAUE0PWTJZtqCYjutGJ0GdcasLI3WSPtgWEkG0jXzDvFywvjeT2G +lwJqM0NktHdXlgjYhDz9lY= X-Google-Smtp-Source: APXvYqzM1ZBWu/BErU/HTgAM/Owa5jAcjxuDmQ/OyVIAtUDYX17WGiOEKj5hG5WVsLjo6A4s8QQQ2g== X-Received: by 2002:a63:c204:: with SMTP id b4mr67971675pgd.335.1554235119420; Tue, 02 Apr 2019 12:58:39 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:38 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 10/11] target/iscsi: Make iscsit_map_iovec() more robust Date: Tue, 2 Apr 2019 12:58:14 -0700 Message-Id: <20190402195815.254796-11-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Make the code for mapping an iovec more robust by checking the bounds of the allocated iovec. This patch avoids that the following crash occurs if a map attempt is made that exceeds the bounds of the iovec that is being mapped: BUG: unable to handle kernel NULL pointer dereference at 00000000 00000014 RIP: 0010:iscsit_map_iovec+0x120/0x190 [iscsi_target_mod] Call Trace: iscsit_get_rx_pdu+0x8a2/0xe00 [iscsi_target_mod] iscsi_target_rx_thread+0x6e/0xa0 [iscsi_target_mod] kthread+0x109/0x140 Cc: Mike Christie Cc: Hannes Reinecke Cc: Christoph Hellwig Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/iscsi/iscsi_target.c | 50 +++++++++++++++++++++-------- 1 file changed, 36 insertions(+), 14 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 8cdea25f1377..f01cdae54277 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -573,7 +573,8 @@ iscsit_xmit_nondatain_pdu(struct iscsi_conn *conn, struct iscsi_cmd *cmd, return 0; } -static int iscsit_map_iovec(struct iscsi_cmd *, struct kvec *, u32, u32); +static int iscsit_map_iovec(struct iscsi_cmd *cmd, struct kvec *iov, int nvec, + u32 data_offset, u32 data_length); static void iscsit_unmap_iovec(struct iscsi_cmd *); static u32 iscsit_do_crypto_hash_sg(struct ahash_request *, struct iscsi_cmd *, u32, u32, u32, u8 *); @@ -604,7 +605,8 @@ iscsit_xmit_datain_pdu(struct iscsi_conn *conn, struct iscsi_cmd *cmd, *header_digest); } - iov_ret = iscsit_map_iovec(cmd, &cmd->iov_data[1], + iov_ret = iscsit_map_iovec(cmd, &cmd->iov_data[iov_count], + cmd->orig_iov_data_count - (iov_count + 2), datain->offset, datain->length); if (iov_ret < 0) return -1; @@ -886,13 +888,10 @@ EXPORT_SYMBOL(iscsit_reject_cmd); * Map some portion of the allocated scatterlist to an iovec, suitable for * kernel sockets to copy data in/out. */ -static int iscsit_map_iovec( - struct iscsi_cmd *cmd, - struct kvec *iov, - u32 data_offset, - u32 data_length) +static int iscsit_map_iovec(struct iscsi_cmd *cmd, struct kvec *iov, int nvec, + u32 data_offset, u32 data_length) { - u32 i = 0; + u32 i = 0, orig_data_length = data_length; struct scatterlist *sg; unsigned int page_off; @@ -901,9 +900,12 @@ static int iscsit_map_iovec( */ u32 ent = data_offset / PAGE_SIZE; + if (!data_length) + return 0; + if (ent >= cmd->se_cmd.t_data_nents) { pr_err("Initial page entry out-of-bounds\n"); - return -1; + goto overflow; } sg = &cmd->se_cmd.t_data_sg[ent]; @@ -913,7 +915,12 @@ static int iscsit_map_iovec( cmd->first_data_sg_off = page_off; while (data_length) { - u32 cur_len = min_t(u32, data_length, sg->length - page_off); + u32 cur_len; + + if (WARN_ON_ONCE(!sg || i >= nvec)) + goto overflow; + + cur_len = min_t(u32, data_length, sg->length - page_off); iov[i].iov_base = kmap(sg_page(sg)) + sg->offset + page_off; iov[i].iov_len = cur_len; @@ -927,6 +934,16 @@ static int iscsit_map_iovec( cmd->kmapped_nents = i; return i; + +overflow: + pr_err("offset %d + length %d overflow; %d/%d; sg-list:\n", + data_offset, orig_data_length, i, nvec); + for_each_sg(cmd->se_cmd.t_data_sg, sg, + cmd->se_cmd.t_data_nents, i) { + pr_err("[%d] off %d len %d\n", + i, sg->offset, sg->length); + } + return -1; } static void iscsit_unmap_iovec(struct iscsi_cmd *cmd) @@ -1576,8 +1593,8 @@ iscsit_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, rx_size += payload_length; iov = &cmd->iov_data[0]; - iov_ret = iscsit_map_iovec(cmd, iov, be32_to_cpu(hdr->offset), - payload_length); + iov_ret = iscsit_map_iovec(cmd, iov, cmd->orig_iov_data_count - 2, + be32_to_cpu(hdr->offset), payload_length); if (iov_ret < 0) return -1; @@ -1597,6 +1614,7 @@ iscsit_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, rx_size += ISCSI_CRC_LEN; } + WARN_ON_ONCE(iov_count > cmd->orig_iov_data_count); rx_got = rx_data(conn, &cmd->iov_data[0], iov_count, rx_size); iscsit_unmap_iovec(cmd); @@ -1862,6 +1880,7 @@ static int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd, rx_size += ISCSI_CRC_LEN; } + WARN_ON_ONCE(niov > ARRAY_SIZE(cmd->iov_misc)); rx_got = rx_data(conn, &cmd->iov_misc[0], niov, rx_size); if (rx_got != rx_size) { ret = -1; @@ -2267,6 +2286,7 @@ iscsit_handle_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, rx_size += ISCSI_CRC_LEN; } + WARN_ON_ONCE(niov > ARRAY_SIZE(iov)); rx_got = rx_data(conn, &iov[0], niov, rx_size); if (rx_got != rx_size) goto reject; @@ -2581,8 +2601,9 @@ static int iscsit_handle_immediate_data( BUG_ON(cmd->write_data_done > cmd->se_cmd.data_length); rx_size = min(cmd->se_cmd.data_length - cmd->write_data_done, length); - iov_ret = iscsit_map_iovec(cmd, cmd->iov_data, cmd->write_data_done, - rx_size); + iov_ret = iscsit_map_iovec(cmd, cmd->iov_data, + cmd->orig_iov_data_count - 2, + cmd->write_data_done, rx_size); if (iov_ret < 0) return IMMEDIATE_DATA_CANNOT_RECOVER; @@ -2618,6 +2639,7 @@ static int iscsit_handle_immediate_data( rx_size += ISCSI_CRC_LEN; } + WARN_ON_ONCE(iov_count > cmd->orig_iov_data_count); rx_got = rx_data(conn, &cmd->iov_data[0], iov_count, rx_size); iscsit_unmap_iovec(cmd); From patchwork Tue Apr 2 19:58:15 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10882285 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 69FC31390 for ; Tue, 2 Apr 2019 19:58:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5389C2875F for ; Tue, 2 Apr 2019 19:58:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 47D01288D7; Tue, 2 Apr 2019 19:58:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D4E3D2875F for ; Tue, 2 Apr 2019 19:58:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726411AbfDBT6l (ORCPT ); Tue, 2 Apr 2019 15:58:41 -0400 Received: from mail-pg1-f196.google.com ([209.85.215.196]:46615 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726157AbfDBT6l (ORCPT ); Tue, 2 Apr 2019 15:58:41 -0400 Received: by mail-pg1-f196.google.com with SMTP id q1so7065835pgv.13 for ; Tue, 02 Apr 2019 12:58:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=m1ssuxZ5fLmhPCwpKh5+eqmocEuxtkZsTh7teTE8c8k=; b=e8GKTGS5AG+WD20SoLjBU439qaOWnrxGQQCxqDio6nma86A1w6xteJaswSikdNso6Z 3AmM3gYnPXxx0viHUclGNW8wbj8IYsrTID9jlE8Grv/L9PFRvWc5Fc4egPrN8B0CRWra 7iDdYdlLfL8WNd7/sIaDEQLf+6nCb3TwwPcLSQfLlBszEn7yNmZS2jxFVWb9xuIthsWm 6tfU+BsxAoO4Swl/zTjQXJW2HxcA+LaJcoLZzXf6tGqj7XTHFBmG7zw+QqP48aEWgX9T rJnj/e+/xyaYyg8/PSO/ekQopnn5TyYkkvfIRdPyFvRiIFmEqwWQ+Pui/1LwhzzNxtz1 wQXQ== X-Gm-Message-State: APjAAAWdG6hws4yQ22aLovT4Wl0kBm7lCBdr2fxu1aiigc7XLo098rrT VTgpAtAMhd8iK7skfCY7uFc= X-Google-Smtp-Source: APXvYqzcLb1G/day4huvKgH77U8Fe/UgGhdRyG2k7jCBsu398IEYkBLli99PUmSqAoQEilLkYBXqag== X-Received: by 2002:a65:610a:: with SMTP id z10mr37323000pgu.23.1554235120479; Tue, 02 Apr 2019 12:58:40 -0700 (PDT) Received: from desktop-bart.svl.corp.google.com ([2620:15c:2cd:203:5cdc:422c:7b28:ebb5]) by smtp.gmail.com with ESMTPSA id o5sm49055490pfa.135.2019.04.02.12.58.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Apr 2019 12:58:39 -0700 (PDT) From: Bart Van Assche To: "Martin K . Petersen" Cc: Mike Christie , Christoph Hellwig , target-devel@vger.kernel.org, Bart Van Assche , Mike Christie , Hannes Reinecke , Nicholas Bellinger Subject: [PATCH 11/11] target/iscsi: Make sure PDU processing continues if parsing a command fails Date: Tue, 2 Apr 2019 12:58:15 -0700 Message-Id: <20190402195815.254796-12-bvanassche@acm.org> X-Mailer: git-send-email 2.20.GIT In-Reply-To: <20190402195815.254796-1-bvanassche@acm.org> References: <20190402195815.254796-1-bvanassche@acm.org> MIME-Version: 1.0 Sender: target-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: target-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Currently the iSCSI target driver sends a CHECK CONDITION code back to the initiator if the immediate data buffer is too large but it does not discard that immediate data buffer. The result is that the iSCSI target driver attempts to parse the immediate data itself as iSCSI PDUs and that all further iSCSI communication fails. Fix this by receiving and discarding too large immediate data buffers. Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Signed-off-by: Bart Van Assche --- drivers/target/iscsi/iscsi_target.c | 39 +++++++++++++---------------- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index f01cdae54277..59d32453b891 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -1285,27 +1285,27 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr, bool dump_payload) { int cmdsn_ret = 0, immed_ret = IMMEDIATE_DATA_NORMAL_OPERATION; + int rc; + /* * Special case for Unsupported SAM WRITE Opcodes and ImmediateData=Yes. */ - if (dump_payload) - goto after_immediate_data; - /* - * Check for underflow case where both EDTL and immediate data payload - * exceeds what is presented by CDB's TRANSFER LENGTH, and what has - * already been set in target_cmd_size_check() as se_cmd->data_length. - * - * For this special case, fail the command and dump the immediate data - * payload. - */ - if (cmd->first_burst_len > cmd->se_cmd.data_length) { - cmd->sense_reason = TCM_INVALID_CDB_FIELD; - goto after_immediate_data; + if (dump_payload) { + u32 length = min(cmd->se_cmd.data_length - cmd->write_data_done, + cmd->first_burst_len); + + pr_debug("Dumping min(%d - %d, %d) = %d bytes of immediate data\n", + cmd->se_cmd.data_length, cmd->write_data_done, + cmd->first_burst_len, length); + rc = iscsit_dump_data_payload(cmd->conn, length, 1); + pr_debug("Finished dumping immediate data\n"); + if (rc < 0) + immed_ret = IMMEDIATE_DATA_CANNOT_RECOVER; + } else { + immed_ret = iscsit_handle_immediate_data(cmd, hdr, + cmd->first_burst_len); } - immed_ret = iscsit_handle_immediate_data(cmd, hdr, - cmd->first_burst_len); -after_immediate_data: if (immed_ret == IMMEDIATE_DATA_NORMAL_OPERATION) { /* * A PDU/CmdSN carrying Immediate Data passed @@ -1318,12 +1318,9 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr, return -1; if (cmd->sense_reason || cmdsn_ret == CMDSN_LOWER_THAN_EXP) { - int rc; - - rc = iscsit_dump_data_payload(cmd->conn, - cmd->first_burst_len, 1); target_put_sess_cmd(&cmd->se_cmd); - return rc; + + return 0; } else if (cmd->unsolicited_data) iscsit_set_unsolicited_dataout(cmd);