3.1 patches

added patches:
	target-fix-incorrect-se_cmd-assignment-in-core_tmr_drain_tmr_list.patch
	target-fix-wrong-se_tmr-being-added-to-drain_tmr_list.patch

diff --git a/queue-3.1/series b/queue-3.1/series
index fc1b57e7e8d88c34cacdb1351e0735564945d0b8..b84196cb3042ab10f7315b1f71cd7ccf7cb3a5e9 100644 (file)
--- a/queue-3.1/series
+++ b/queue-3.1/series
@@ -229,3 +229,5 @@ hpsa-add-small-delay-when-using-pci-power-management-to-reset-for-kump.patch
 blk-flush-fix-invalid-bug_on-in-blk_insert_flush.patch
 blk-flush-move-the-queue-kick-into.patch
 vfs-we-need-to-set-lookup_jumped-on-mountpoint-crossing.patch
+target-fix-incorrect-se_cmd-assignment-in-core_tmr_drain_tmr_list.patch
+target-fix-wrong-se_tmr-being-added-to-drain_tmr_list.patch

diff --git a/queue-3.1/target-fix-incorrect-se_cmd-assignment-in-core_tmr_drain_tmr_list.patch b/queue-3.1/target-fix-incorrect-se_cmd-assignment-in-core_tmr_drain_tmr_list.patch
new file mode 100644 (file)
index 0000000..f483ef2
--- /dev/null
+++ b/queue-3.1/target-fix-incorrect-se_cmd-assignment-in-core_tmr_drain_tmr_list.patch
@@ -0,0 +1,34 @@
+From 80ccbc8e00f7001d79dd503c2781487906b98611 Mon Sep 17 00:00:00 2001
+From: Joern Engel <joern@logfs.org>
+Date: Tue, 25 Oct 2011 22:08:43 -0700
+Subject: target: Fix incorrect se_cmd assignment in core_tmr_drain_tmr_list
+
+From: Joern Engel <joern@logfs.org>
+
+commit 80ccbc8e00f7001d79dd503c2781487906b98611 upstream.
+
+This patch fixes a bug in core_tmr_drain_tmr_list() where drain_tmr_list
+was using the wrong se_tmr_req for cmd assignment due to a typo during the
+LUN_RESET re-org.  This was resulting in general protection faults while
+using the leftover bogus *tmr_p pointer from list_for_each_entry_safe().
+
+Signed-off-by: Joern Engel <joern@logfs.org>
+Cc: Joern Engel <joern@logfs.org>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_tmr.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -155,7 +155,7 @@ static void core_tmr_drain_tmr_list(
+       while (!list_empty(&drain_tmr_list)) {
+               tmr = list_entry(drain_tmr_list.next, struct se_tmr_req, tmr_list);
+               list_del(&tmr->tmr_list);
+-              cmd = tmr_p->task_cmd;
++              cmd = tmr->task_cmd;
+ 
+               pr_debug("LUN_RESET: %s releasing TMR %p Function: 0x%02x,"
+                       " Response: 0x%02x, t_state: %d\n",

diff --git a/queue-3.1/target-fix-wrong-se_tmr-being-added-to-drain_tmr_list.patch b/queue-3.1/target-fix-wrong-se_tmr-being-added-to-drain_tmr_list.patch
new file mode 100644 (file)
index 0000000..d25c937
--- /dev/null
+++ b/queue-3.1/target-fix-wrong-se_tmr-being-added-to-drain_tmr_list.patch
@@ -0,0 +1,35 @@
+From 6eb40b2af4908e9aee71e43e7a384243128c56dd Mon Sep 17 00:00:00 2001
+From: Joern Engel <joern@logfs.org>
+Date: Wed, 26 Oct 2011 13:37:56 -0700
+Subject: target: Fix wrong se_tmr being added to drain_tmr_list
+
+From: Joern Engel <joern@logfs.org>
+
+commit 6eb40b2af4908e9aee71e43e7a384243128c56dd upstream.
+
+This patch fixes another bug from LUN_RESET re-org fallout in
+core_tmr_drain_tmr_list() that was adding the wrong se_tmr_req
+into the local drain_tmr_list to be walked + released.
+
+Signed-off-by: Joern Engel <joern@logfs.org>
+Cc: Joern Engel <joern@logfs.org>
+Reviewed-by: Roland Dreier <roland@purestorage.com>
+Cc: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_tmr.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -148,7 +148,7 @@ static void core_tmr_drain_tmr_list(
+               }
+               spin_unlock(&cmd->t_state_lock);
+ 
+-              list_move_tail(&tmr->tmr_list, &drain_tmr_list);
++              list_move_tail(&tmr_p->tmr_list, &drain_tmr_list);
+       }
+       spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
+