mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull scsi target fixes from Nicholas Bellinger: "Apologies for the late pull request. Here are the outstanding target-pending fixes for v4.1 code. The series contains three patches from Sagi + Co that address a few iser-target issues that have been uncovered during recent testing at Mellanox. Patch #1 has a v3.16+ stable tag, and #2-3 have v3.10+ stable tags" * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: iser-target: Fix possible use-after-free iser-target: release stale iser connections iser-target: Fix variable-length response error completion
This commit is contained in:
commit
d2228e4310
1 changed files with 22 additions and 3 deletions
|
@ -65,6 +65,8 @@ static int
|
|||
isert_rdma_accept(struct isert_conn *isert_conn);
|
||||
struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
|
||||
|
||||
static void isert_release_work(struct work_struct *work);
|
||||
|
||||
static inline bool
|
||||
isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)
|
||||
{
|
||||
|
@ -648,6 +650,7 @@ isert_init_conn(struct isert_conn *isert_conn)
|
|||
mutex_init(&isert_conn->mutex);
|
||||
spin_lock_init(&isert_conn->pool_lock);
|
||||
INIT_LIST_HEAD(&isert_conn->fr_pool);
|
||||
INIT_WORK(&isert_conn->release_work, isert_release_work);
|
||||
}
|
||||
|
||||
static void
|
||||
|
@ -925,6 +928,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
|
|||
{
|
||||
struct isert_np *isert_np = cma_id->context;
|
||||
struct isert_conn *isert_conn;
|
||||
bool terminating = false;
|
||||
|
||||
if (isert_np->np_cm_id == cma_id)
|
||||
return isert_np_cma_handler(cma_id->context, event);
|
||||
|
@ -932,12 +936,25 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
|
|||
isert_conn = cma_id->qp->qp_context;
|
||||
|
||||
mutex_lock(&isert_conn->mutex);
|
||||
terminating = (isert_conn->state == ISER_CONN_TERMINATING);
|
||||
isert_conn_terminate(isert_conn);
|
||||
mutex_unlock(&isert_conn->mutex);
|
||||
|
||||
isert_info("conn %p completing wait\n", isert_conn);
|
||||
complete(&isert_conn->wait);
|
||||
|
||||
if (terminating)
|
||||
goto out;
|
||||
|
||||
mutex_lock(&isert_np->np_accept_mutex);
|
||||
if (!list_empty(&isert_conn->accept_node)) {
|
||||
list_del_init(&isert_conn->accept_node);
|
||||
isert_put_conn(isert_conn);
|
||||
queue_work(isert_release_wq, &isert_conn->release_work);
|
||||
}
|
||||
mutex_unlock(&isert_np->np_accept_mutex);
|
||||
|
||||
out:
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -2380,7 +2397,6 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
|
|||
page_off = offset % PAGE_SIZE;
|
||||
|
||||
send_wr->sg_list = ib_sge;
|
||||
send_wr->num_sge = sg_nents;
|
||||
send_wr->wr_id = (uintptr_t)&isert_cmd->tx_desc;
|
||||
/*
|
||||
* Perform mapping of TCM scatterlist memory ib_sge dma_addr.
|
||||
|
@ -2400,14 +2416,17 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
|
|||
ib_sge->addr, ib_sge->length, ib_sge->lkey);
|
||||
page_off = 0;
|
||||
data_left -= ib_sge->length;
|
||||
if (!data_left)
|
||||
break;
|
||||
ib_sge++;
|
||||
isert_dbg("Incrementing ib_sge pointer to %p\n", ib_sge);
|
||||
}
|
||||
|
||||
send_wr->num_sge = ++i;
|
||||
isert_dbg("Set outgoing sg_list: %p num_sg: %u from TCM SGLs\n",
|
||||
send_wr->sg_list, send_wr->num_sge);
|
||||
|
||||
return sg_nents;
|
||||
return send_wr->num_sge;
|
||||
}
|
||||
|
||||
static int
|
||||
|
@ -3366,7 +3385,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
|
|||
isert_wait4flush(isert_conn);
|
||||
isert_wait4logout(isert_conn);
|
||||
|
||||
INIT_WORK(&isert_conn->release_work, isert_release_work);
|
||||
queue_work(isert_release_wq, &isert_conn->release_work);
|
||||
}
|
||||
|
||||
|
@ -3374,6 +3392,7 @@ static void isert_free_conn(struct iscsi_conn *conn)
|
|||
{
|
||||
struct isert_conn *isert_conn = conn->context;
|
||||
|
||||
isert_wait4flush(isert_conn);
|
||||
isert_put_conn(isert_conn);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue