--- /dev/null
+From 3e03c4b01da3e6a5f3081eb0aa252490fe83e352 Mon Sep 17 00:00:00 2001
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+Date: Sun, 6 Sep 2015 14:52:21 +0300
+Subject: iser-target: Put the reference on commands waiting for unsol data
+
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+
+commit 3e03c4b01da3e6a5f3081eb0aa252490fe83e352 upstream.
+
+The iscsi target core teardown sequence calls wait_conn for
+all active commands to finish gracefully by:
+- move the queue-pair to error state
+- drain all the completions
+- wait for the core to finish handling all session commands
+
+However, when tearing down a session while there are sequenced
+commands that are still waiting for unsolicited data outs, we can
+block forever as these are missing an extra reference put.
+
+We basically need the equivalent of iscsit_free_queue_reqs_for_conn()
+which is called after wait_conn has returned. Address this by an
+explicit walk on conn_cmd_list and put the extra reference.
+
+Signed-off-by: Jenny Derzhavetz <jennyf@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 38 +++++++++++++++++++++++++++++++-
+ 1 file changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -3386,6 +3386,41 @@ isert_wait4flush(struct isert_conn *iser
+ wait_for_completion(&isert_conn->wait_comp_err);
+ }
+
++/**
++ * isert_put_unsol_pending_cmds() - Drop commands waiting for
++ * unsolicitate dataout
++ * @conn: iscsi connection
++ *
++ * We might still have commands that are waiting for unsolicited
++ * dataouts messages. We must put the extra reference on those
++ * before blocking on the target_wait_for_session_cmds
++ */
++static void
++isert_put_unsol_pending_cmds(struct iscsi_conn *conn)
++{
++ struct iscsi_cmd *cmd, *tmp;
++ static LIST_HEAD(drop_cmd_list);
++
++ spin_lock_bh(&conn->cmd_lock);
++ list_for_each_entry_safe(cmd, tmp, &conn->conn_cmd_list, i_conn_node) {
++ if ((cmd->cmd_flags & ICF_NON_IMMEDIATE_UNSOLICITED_DATA) &&
++ (cmd->write_data_done < conn->sess->sess_ops->FirstBurstLength) &&
++ (cmd->write_data_done < cmd->se_cmd.data_length))
++ list_move_tail(&cmd->i_conn_node, &drop_cmd_list);
++ }
++ spin_unlock_bh(&conn->cmd_lock);
++
++ list_for_each_entry_safe(cmd, tmp, &drop_cmd_list, i_conn_node) {
++ list_del_init(&cmd->i_conn_node);
++ if (cmd->i_state != ISTATE_REMOVE) {
++ struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
++
++ isert_info("conn %p dropping cmd %p\n", conn, cmd);
++ isert_put_cmd(isert_cmd, true);
++ }
++ }
++}
++
+ static void isert_wait_conn(struct iscsi_conn *conn)
+ {
+ struct isert_conn *isert_conn = conn->context;
+@@ -3404,8 +3439,9 @@ static void isert_wait_conn(struct iscsi
+ isert_conn_terminate(isert_conn);
+ mutex_unlock(&isert_conn->mutex);
+
+- isert_wait4cmds(conn);
+ isert_wait4flush(isert_conn);
++ isert_put_unsol_pending_cmds(conn);
++ isert_wait4cmds(conn);
+ isert_wait4logout(isert_conn);
+
+ queue_work(isert_release_wq, &isert_conn->release_work);
--- /dev/null
+From a4c15cd957cbd728f685645de7a150df5912591a Mon Sep 17 00:00:00 2001
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+Date: Sun, 6 Sep 2015 14:52:20 +0300
+Subject: iser-target: remove command with state ISTATE_REMOVE
+
+From: Jenny Derzhavetz <jennyf@mellanox.com>
+
+commit a4c15cd957cbd728f685645de7a150df5912591a upstream.
+
+As documented in iscsit_sequence_cmd:
+/*
+ * Existing callers for iscsit_sequence_cmd() will silently
+ * ignore commands with CMDSN_LOWER_THAN_EXP, so force this
+ * return for CMDSN_MAXCMDSN_OVERRUN as well..
+ */
+
+We need to silently finish a command when it's in ISTATE_REMOVE.
+This fixes an teardown hang we were seeing where a mis-behaved
+initiator (triggered by allocation error injections) sent us a
+cmdsn which was lower than expected.
+
+Signed-off-by: Jenny Derzhavetz <jennyf@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -3012,9 +3012,16 @@ isert_get_dataout(struct iscsi_conn *con
+ static int
+ isert_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state)
+ {
+- int ret;
++ struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
++ int ret = 0;
+
+ switch (state) {
++ case ISTATE_REMOVE:
++ spin_lock_bh(&conn->cmd_lock);
++ list_del_init(&cmd->i_conn_node);
++ spin_unlock_bh(&conn->cmd_lock);
++ isert_put_cmd(isert_cmd, true);
++ break;
+ case ISTATE_SEND_NOPIN_WANT_RESPONSE:
+ ret = isert_put_nopin(cmd, conn, false);
+ break;
--- /dev/null
+From 537b604c8b3aa8b96fe35f87dd085816552e294c Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Thu, 27 Aug 2015 20:16:37 +0200
+Subject: scsi: fix scsi_error_handler vs. scsi_host_dev_release race
+
+From: Michal Hocko <mhocko@suse.com>
+
+commit 537b604c8b3aa8b96fe35f87dd085816552e294c upstream.
+
+b9d5c6b7ef57 ("[SCSI] cleanup setting task state in
+scsi_error_handler()") has introduced a race between scsi_error_handler
+and scsi_host_dev_release resulting in the hang when the device goes
+away because scsi_error_handler might miss a wake up:
+
+CPU0 CPU1
+scsi_error_handler scsi_host_dev_release
+ kthread_stop()
+ kthread_should_stop()
+ test_bit(KTHREAD_SHOULD_STOP)
+ set_bit(KTHREAD_SHOULD_STOP)
+ wake_up_process()
+ wait_for_completion()
+
+ set_current_state(TASK_INTERRUPTIBLE)
+ schedule()
+
+The most straightforward solution seems to be to invert the ordering of
+the set_current_state and kthread_should_stop.
+
+The issue has been noticed during reboot test on a 3.0 based kernel but
+the current code seems to be affected in the same way.
+
+[jejb: additional comment added]
+Reported-and-debugged-by: Mike Mayer <Mike.Meyer@teradata.com>
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_error.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -2169,8 +2169,17 @@ int scsi_error_handler(void *data)
+ * We never actually get interrupted because kthread_run
+ * disables signal delivery for the created thread.
+ */
+- while (!kthread_should_stop()) {
++ while (true) {
++ /*
++ * The sequence in kthread_stop() sets the stop flag first
++ * then wakes the process. To avoid missed wakeups, the task
++ * should always be in a non running state before the stop
++ * flag is checked
++ */
+ set_current_state(TASK_INTERRUPTIBLE);
++ if (kthread_should_stop())
++ break;
++
+ if ((shost->host_failed == 0 && shost->host_eh_scheduled == 0) ||
+ shost->host_failed != atomic_read(&shost->host_busy)) {
+ SCSI_LOG_ERROR_RECOVERY(1,
revert-kvm-svm-use-npt-page-attributes.patch
revert-kvm-svm-sync-g_pat-with-guest-written-pat-value.patch
time-fix-timekeeping_freqadjust-s-incorrect-use-of-abs-instead-of-abs64.patch
+target-iscsi-fix-np_ip-bracket-issue-by-removing-np_ip.patch
+scsi-fix-scsi_error_handler-vs.-scsi_host_dev_release-race.patch
+target-attach-extended_copy-local-i-o-descriptors-to-xcopy_pt_sess.patch
+target-fix-pr-registration-aptpl-rcu-conversion-regression.patch
+iser-target-remove-command-with-state-istate_remove.patch
+iser-target-put-the-reference-on-commands-waiting-for-unsol-data.patch
--- /dev/null
+From 4416f89b8cfcb794d040fc3b68e5fb159b7d8d02 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 3 Sep 2015 06:30:45 +0000
+Subject: target: Attach EXTENDED_COPY local I/O descriptors to xcopy_pt_sess
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 4416f89b8cfcb794d040fc3b68e5fb159b7d8d02 upstream.
+
+This patch is a >= v4.1 regression bug-fix where control CDB
+emulation logic in commit 38b57f82 now expects a se_cmd->se_sess
+pointer to exist when determining T10-PI support is to be exposed
+for initiator host ports.
+
+To address this bug, go ahead and add locally generated se_cmd
+descriptors for copy-offload block-copy to it's own stand-alone
+se_session nexus, while the parent EXTENDED_COPY se_cmd descriptor
+remains associated with it's originating se_cmd->se_sess nexus.
+
+Note a valid se_cmd->se_sess is also required for future support
+of WRITE_INSERT and READ_STRIP software emulation when submitting
+backend I/O to se_device that exposes T10-PI suport.
+
+Reported-by: Alex Gorbachev <ag@iss-integration.com>
+Tested-by: Alex Gorbachev <ag@iss-integration.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Doug Gilbert <dgilbert@interlog.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_xcopy.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -450,6 +450,8 @@ int target_xcopy_setup_pt(void)
+ memset(&xcopy_pt_sess, 0, sizeof(struct se_session));
+ INIT_LIST_HEAD(&xcopy_pt_sess.sess_list);
+ INIT_LIST_HEAD(&xcopy_pt_sess.sess_acl_list);
++ INIT_LIST_HEAD(&xcopy_pt_sess.sess_cmd_list);
++ spin_lock_init(&xcopy_pt_sess.sess_cmd_lock);
+
+ xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg;
+ xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess;
+@@ -644,7 +646,7 @@ static int target_xcopy_read_source(
+ pr_debug("XCOPY: Built READ_16: LBA: %llu Sectors: %u Length: %u\n",
+ (unsigned long long)src_lba, src_sectors, length);
+
+- transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
++ transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length,
+ DMA_FROM_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
+ xop->src_pt_cmd = xpt_cmd;
+
+@@ -704,7 +706,7 @@ static int target_xcopy_write_destinatio
+ pr_debug("XCOPY: Built WRITE_16: LBA: %llu Sectors: %u Length: %u\n",
+ (unsigned long long)dst_lba, dst_sectors, length);
+
+- transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
++ transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length,
+ DMA_TO_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
+ xop->dst_pt_cmd = xpt_cmd;
+
--- /dev/null
+From 3ccd6e83df8a0d4a664edeecc453c4fa046395fb Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Sun, 13 Sep 2015 02:30:46 -0700
+Subject: target: Fix PR registration + APTPL RCU conversion regression
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 3ccd6e83df8a0d4a664edeecc453c4fa046395fb upstream.
+
+This patch fixes a v4.2+ regression introduced by commit 79dc9c9e86
+where lookup of t10_pr_registration->pr_reg_deve and associated
+->pr_kref get was missing from __core_scsi3_do_alloc_registration(),
+which is responsible for setting DEF_PR_REG_ACTIVE.
+
+This would result in REGISTER operations completing successfully,
+but subsequent core_scsi3_pr_seq_non_holder() checking would fail
+with !DEF_PR_REG_ACTIVE -> RESERVATION CONFLICT status.
+
+Update __core_scsi3_add_registration() to drop ->pr_kref reference
+after registration and any optional ALL_TG_PT=1 processing has
+completed. Update core_scsi3_decode_spec_i_port() to release
+the new parent local_pr_reg->pr_kref as well.
+
+Also, update __core_scsi3_check_aptpl_registration() to perform
+the same target_nacl_find_deve() lookup + ->pr_kref get, now that
+__core_scsi3_add_registration() expects to drop the reference.
+
+Finally, since there are cases when se_dev_entry->se_lun_acl can
+still be dereferenced in core_scsi3_lunacl_undepend_item() while
+holding ->pr_kref, go ahead and move explicit rcu_assign_pointer()
+NULL assignments within core_disable_device_list_for_node() until
+after orig->pr_comp finishes.
+
+Reported-by: Scott L. Lykens <scott@lykens.org>
+Tested-by: Scott L. Lykens <scott@lykens.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_device.c | 5 +
+ drivers/target/target_core_pr.c | 91 ++++++++++++++++++++++++++----------
+ 2 files changed, 70 insertions(+), 26 deletions(-)
+
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -427,8 +427,6 @@ void core_disable_device_list_for_node(
+
+ hlist_del_rcu(&orig->link);
+ clear_bit(DEF_PR_REG_ACTIVE, &orig->deve_flags);
+- rcu_assign_pointer(orig->se_lun, NULL);
+- rcu_assign_pointer(orig->se_lun_acl, NULL);
+ orig->lun_flags = 0;
+ orig->creation_time = 0;
+ orig->attach_count--;
+@@ -439,6 +437,9 @@ void core_disable_device_list_for_node(
+ kref_put(&orig->pr_kref, target_pr_kref_release);
+ wait_for_completion(&orig->pr_comp);
+
++ rcu_assign_pointer(orig->se_lun, NULL);
++ rcu_assign_pointer(orig->se_lun_acl, NULL);
++
+ kfree_rcu(orig, rcu_head);
+
+ core_scsi3_free_pr_reg_from_nacl(dev, nacl);
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -618,7 +618,7 @@ static struct t10_pr_registration *__cor
+ struct se_device *dev,
+ struct se_node_acl *nacl,
+ struct se_lun *lun,
+- struct se_dev_entry *deve,
++ struct se_dev_entry *dest_deve,
+ u64 mapped_lun,
+ unsigned char *isid,
+ u64 sa_res_key,
+@@ -640,7 +640,29 @@ static struct t10_pr_registration *__cor
+ INIT_LIST_HEAD(&pr_reg->pr_reg_atp_mem_list);
+ atomic_set(&pr_reg->pr_res_holders, 0);
+ pr_reg->pr_reg_nacl = nacl;
+- pr_reg->pr_reg_deve = deve;
++ /*
++ * For destination registrations for ALL_TG_PT=1 and SPEC_I_PT=1,
++ * the se_dev_entry->pr_ref will have been already obtained by
++ * core_get_se_deve_from_rtpi() or __core_scsi3_alloc_registration().
++ *
++ * Otherwise, locate se_dev_entry now and obtain a reference until
++ * registration completes in __core_scsi3_add_registration().
++ */
++ if (dest_deve) {
++ pr_reg->pr_reg_deve = dest_deve;
++ } else {
++ rcu_read_lock();
++ pr_reg->pr_reg_deve = target_nacl_find_deve(nacl, mapped_lun);
++ if (!pr_reg->pr_reg_deve) {
++ rcu_read_unlock();
++ pr_err("Unable to locate PR deve %s mapped_lun: %llu\n",
++ nacl->initiatorname, mapped_lun);
++ kmem_cache_free(t10_pr_reg_cache, pr_reg);
++ return NULL;
++ }
++ kref_get(&pr_reg->pr_reg_deve->pr_kref);
++ rcu_read_unlock();
++ }
+ pr_reg->pr_res_mapped_lun = mapped_lun;
+ pr_reg->pr_aptpl_target_lun = lun->unpacked_lun;
+ pr_reg->tg_pt_sep_rtpi = lun->lun_rtpi;
+@@ -936,17 +958,29 @@ static int __core_scsi3_check_aptpl_regi
+ !(strcmp(pr_reg->pr_tport, t_port)) &&
+ (pr_reg->pr_reg_tpgt == tpgt) &&
+ (pr_reg->pr_aptpl_target_lun == target_lun)) {
++ /*
++ * Obtain the ->pr_reg_deve pointer + reference, that
++ * is released by __core_scsi3_add_registration() below.
++ */
++ rcu_read_lock();
++ pr_reg->pr_reg_deve = target_nacl_find_deve(nacl, mapped_lun);
++ if (!pr_reg->pr_reg_deve) {
++ pr_err("Unable to locate PR APTPL %s mapped_lun:"
++ " %llu\n", nacl->initiatorname, mapped_lun);
++ rcu_read_unlock();
++ continue;
++ }
++ kref_get(&pr_reg->pr_reg_deve->pr_kref);
++ rcu_read_unlock();
+
+ pr_reg->pr_reg_nacl = nacl;
+ pr_reg->tg_pt_sep_rtpi = lun->lun_rtpi;
+-
+ list_del(&pr_reg->pr_reg_aptpl_list);
+ spin_unlock(&pr_tmpl->aptpl_reg_lock);
+ /*
+ * At this point all of the pointers in *pr_reg will
+ * be setup, so go ahead and add the registration.
+ */
+-
+ __core_scsi3_add_registration(dev, nacl, pr_reg, 0, 0);
+ /*
+ * If this registration is the reservation holder,
+@@ -1044,18 +1078,11 @@ static void __core_scsi3_add_registratio
+
+ __core_scsi3_dump_registration(tfo, dev, nacl, pr_reg, register_type);
+ spin_unlock(&pr_tmpl->registration_lock);
+-
+- rcu_read_lock();
+- deve = pr_reg->pr_reg_deve;
+- if (deve)
+- set_bit(DEF_PR_REG_ACTIVE, &deve->deve_flags);
+- rcu_read_unlock();
+-
+ /*
+ * Skip extra processing for ALL_TG_PT=0 or REGISTER_AND_MOVE.
+ */
+ if (!pr_reg->pr_reg_all_tg_pt || register_move)
+- return;
++ goto out;
+ /*
+ * Walk pr_reg->pr_reg_atp_list and add registrations for ALL_TG_PT=1
+ * allocated in __core_scsi3_alloc_registration()
+@@ -1075,19 +1102,31 @@ static void __core_scsi3_add_registratio
+ __core_scsi3_dump_registration(tfo, dev, nacl_tmp, pr_reg_tmp,
+ register_type);
+ spin_unlock(&pr_tmpl->registration_lock);
+-
++ /*
++ * Drop configfs group dependency reference and deve->pr_kref
++ * obtained from __core_scsi3_alloc_registration() code.
++ */
+ rcu_read_lock();
+ deve = pr_reg_tmp->pr_reg_deve;
+- if (deve)
++ if (deve) {
+ set_bit(DEF_PR_REG_ACTIVE, &deve->deve_flags);
++ core_scsi3_lunacl_undepend_item(deve);
++ pr_reg_tmp->pr_reg_deve = NULL;
++ }
+ rcu_read_unlock();
+-
+- /*
+- * Drop configfs group dependency reference from
+- * __core_scsi3_alloc_registration()
+- */
+- core_scsi3_lunacl_undepend_item(pr_reg_tmp->pr_reg_deve);
+ }
++out:
++ /*
++ * Drop deve->pr_kref obtained in __core_scsi3_do_alloc_registration()
++ */
++ rcu_read_lock();
++ deve = pr_reg->pr_reg_deve;
++ if (deve) {
++ set_bit(DEF_PR_REG_ACTIVE, &deve->deve_flags);
++ kref_put(&deve->pr_kref, target_pr_kref_release);
++ pr_reg->pr_reg_deve = NULL;
++ }
++ rcu_read_unlock();
+ }
+
+ static int core_scsi3_alloc_registration(
+@@ -1785,9 +1824,11 @@ core_scsi3_decode_spec_i_port(
+ dest_node_acl->initiatorname, i_buf, (dest_se_deve) ?
+ dest_se_deve->mapped_lun : 0);
+
+- if (!dest_se_deve)
++ if (!dest_se_deve) {
++ kref_put(&local_pr_reg->pr_reg_deve->pr_kref,
++ target_pr_kref_release);
+ continue;
+-
++ }
+ core_scsi3_lunacl_undepend_item(dest_se_deve);
+ core_scsi3_nodeacl_undepend_item(dest_node_acl);
+ core_scsi3_tpg_undepend_item(dest_tpg);
+@@ -1823,9 +1864,11 @@ out:
+
+ kmem_cache_free(t10_pr_reg_cache, dest_pr_reg);
+
+- if (!dest_se_deve)
++ if (!dest_se_deve) {
++ kref_put(&local_pr_reg->pr_reg_deve->pr_kref,
++ target_pr_kref_release);
+ continue;
+-
++ }
+ core_scsi3_lunacl_undepend_item(dest_se_deve);
+ core_scsi3_nodeacl_undepend_item(dest_node_acl);
+ core_scsi3_tpg_undepend_item(dest_tpg);
--- /dev/null
+From 76c28f1fcfeb42b47f798fe498351ee1d60086ae Mon Sep 17 00:00:00 2001
+From: Andy Grover <agrover@redhat.com>
+Date: Mon, 24 Aug 2015 10:26:03 -0700
+Subject: target/iscsi: Fix np_ip bracket issue by removing np_ip
+
+From: Andy Grover <agrover@redhat.com>
+
+commit 76c28f1fcfeb42b47f798fe498351ee1d60086ae upstream.
+
+Revert commit 1997e6259, which causes double brackets on ipv6
+inaddr_any addresses.
+
+Since we have np_sockaddr, if we need a textual representation we can
+use "%pISc".
+
+Change iscsit_add_network_portal() and iscsit_add_np() signatures to remove
+*ip_str parameter.
+
+Fix and extend some comments earlier in the function.
+
+Tested to work for :: and ::1 via iscsiadm, previously :: failed, see
+https://bugzilla.redhat.com/show_bug.cgi?id=1249107 .
+
+Signed-off-by: Andy Grover <agrover@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 33 +++++++++++++--------------
+ drivers/target/iscsi/iscsi_target.h | 2 -
+ drivers/target/iscsi/iscsi_target_configfs.c | 14 +++++------
+ drivers/target/iscsi/iscsi_target_login.c | 8 +++---
+ drivers/target/iscsi/iscsi_target_tpg.c | 15 +++++-------
+ drivers/target/iscsi/iscsi_target_tpg.h | 2 -
+ include/target/iscsi/iscsi_target_core.h | 1
+ 7 files changed, 36 insertions(+), 39 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -341,7 +341,6 @@ static struct iscsi_np *iscsit_get_np(
+
+ struct iscsi_np *iscsit_add_np(
+ struct __kernel_sockaddr_storage *sockaddr,
+- char *ip_str,
+ int network_transport)
+ {
+ struct sockaddr_in *sock_in;
+@@ -370,11 +369,9 @@ struct iscsi_np *iscsit_add_np(
+ np->np_flags |= NPF_IP_NETWORK;
+ if (sockaddr->ss_family == AF_INET6) {
+ sock_in6 = (struct sockaddr_in6 *)sockaddr;
+- snprintf(np->np_ip, IPV6_ADDRESS_SPACE, "%s", ip_str);
+ np->np_port = ntohs(sock_in6->sin6_port);
+ } else {
+ sock_in = (struct sockaddr_in *)sockaddr;
+- sprintf(np->np_ip, "%s", ip_str);
+ np->np_port = ntohs(sock_in->sin_port);
+ }
+
+@@ -411,8 +408,8 @@ struct iscsi_np *iscsit_add_np(
+ list_add_tail(&np->np_list, &g_np_list);
+ mutex_unlock(&np_lock);
+
+- pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n",
+- np->np_ip, np->np_port, np->np_transport->name);
++ pr_debug("CORE[0] - Added Network Portal: %pISc:%hu on %s\n",
++ &np->np_sockaddr, np->np_port, np->np_transport->name);
+
+ return np;
+ }
+@@ -481,8 +478,8 @@ int iscsit_del_np(struct iscsi_np *np)
+ list_del(&np->np_list);
+ mutex_unlock(&np_lock);
+
+- pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n",
+- np->np_ip, np->np_port, np->np_transport->name);
++ pr_debug("CORE[0] - Removed Network Portal: %pISc:%hu on %s\n",
++ &np->np_sockaddr, np->np_port, np->np_transport->name);
+
+ iscsit_put_transport(np->np_transport);
+ kfree(np);
+@@ -3464,7 +3461,6 @@ iscsit_build_sendtargets_response(struct
+ tpg_np_list) {
+ struct iscsi_np *np = tpg_np->tpg_np;
+ bool inaddr_any = iscsit_check_inaddr_any(np);
+- char *fmt_str;
+
+ if (np->np_network_transport != network_transport)
+ continue;
+@@ -3492,15 +3488,18 @@ iscsit_build_sendtargets_response(struct
+ }
+ }
+
+- if (np->np_sockaddr.ss_family == AF_INET6)
+- fmt_str = "TargetAddress=[%s]:%hu,%hu";
+- else
+- fmt_str = "TargetAddress=%s:%hu,%hu";
+-
+- len = sprintf(buf, fmt_str,
+- inaddr_any ? conn->local_ip : np->np_ip,
+- np->np_port,
+- tpg->tpgt);
++ if (inaddr_any) {
++ len = sprintf(buf, "TargetAddress="
++ "%s:%hu,%hu",
++ conn->local_ip,
++ np->np_port,
++ tpg->tpgt);
++ } else {
++ len = sprintf(buf, "TargetAddress="
++ "%pISpc,%hu",
++ &np->np_sockaddr,
++ tpg->tpgt);
++ }
+ len += 1;
+
+ if ((len + payload_len) > buffer_len) {
+--- a/drivers/target/iscsi/iscsi_target.h
++++ b/drivers/target/iscsi/iscsi_target.h
+@@ -13,7 +13,7 @@ extern int iscsit_deaccess_np(struct isc
+ extern bool iscsit_check_np_match(struct __kernel_sockaddr_storage *,
+ struct iscsi_np *, int);
+ extern struct iscsi_np *iscsit_add_np(struct __kernel_sockaddr_storage *,
+- char *, int);
++ int);
+ extern int iscsit_reset_np_thread(struct iscsi_np *, struct iscsi_tpg_np *,
+ struct iscsi_portal_group *, bool);
+ extern int iscsit_del_np(struct iscsi_np *);
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -99,7 +99,7 @@ static ssize_t lio_target_np_store_sctp(
+ * Use existing np->np_sockaddr for SCTP network portal reference
+ */
+ tpg_np_sctp = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
+- np->np_ip, tpg_np, ISCSI_SCTP_TCP);
++ tpg_np, ISCSI_SCTP_TCP);
+ if (!tpg_np_sctp || IS_ERR(tpg_np_sctp))
+ goto out;
+ } else {
+@@ -177,7 +177,7 @@ static ssize_t lio_target_np_store_iser(
+ }
+
+ tpg_np_iser = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
+- np->np_ip, tpg_np, ISCSI_INFINIBAND);
++ tpg_np, ISCSI_INFINIBAND);
+ if (IS_ERR(tpg_np_iser)) {
+ rc = PTR_ERR(tpg_np_iser);
+ goto out;
+@@ -248,8 +248,8 @@ static struct se_tpg_np *lio_target_call
+ return ERR_PTR(-EINVAL);
+ }
+ str++; /* Skip over leading "[" */
+- *str2 = '\0'; /* Terminate the IPv6 address */
+- str2++; /* Skip over the "]" */
++ *str2 = '\0'; /* Terminate the unbracketed IPv6 address */
++ str2++; /* Skip over the \0 */
+ port_str = strstr(str2, ":");
+ if (!port_str) {
+ pr_err("Unable to locate \":port\""
+@@ -316,7 +316,7 @@ static struct se_tpg_np *lio_target_call
+ * sys/kernel/config/iscsi/$IQN/$TPG/np/$IP:$PORT/
+ *
+ */
+- tpg_np = iscsit_tpg_add_network_portal(tpg, &sockaddr, str, NULL,
++ tpg_np = iscsit_tpg_add_network_portal(tpg, &sockaddr, NULL,
+ ISCSI_TCP);
+ if (IS_ERR(tpg_np)) {
+ iscsit_put_tpg(tpg);
+@@ -344,8 +344,8 @@ static void lio_target_call_delnpfromtpg
+
+ se_tpg = &tpg->tpg_se_tpg;
+ pr_debug("LIO_Target_ConfigFS: DEREGISTER -> %s TPGT: %hu"
+- " PORTAL: %s:%hu\n", config_item_name(&se_tpg->se_tpg_wwn->wwn_group.cg_item),
+- tpg->tpgt, tpg_np->tpg_np->np_ip, tpg_np->tpg_np->np_port);
++ " PORTAL: %pISc:%hu\n", config_item_name(&se_tpg->se_tpg_wwn->wwn_group.cg_item),
++ tpg->tpgt, &tpg_np->tpg_np->np_sockaddr, tpg_np->tpg_np->np_port);
+
+ ret = iscsit_tpg_del_network_portal(tpg, tpg_np);
+ if (ret < 0)
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -823,8 +823,8 @@ static void iscsi_handle_login_thread_ti
+ struct iscsi_np *np = (struct iscsi_np *) data;
+
+ spin_lock_bh(&np->np_thread_lock);
+- pr_err("iSCSI Login timeout on Network Portal %s:%hu\n",
+- np->np_ip, np->np_port);
++ pr_err("iSCSI Login timeout on Network Portal %pISc:%hu\n",
++ &np->np_sockaddr, np->np_port);
+
+ if (np->np_login_timer_flags & ISCSI_TF_STOP) {
+ spin_unlock_bh(&np->np_thread_lock);
+@@ -1302,8 +1302,8 @@ static int __iscsi_target_login_thread(s
+ spin_lock_bh(&np->np_thread_lock);
+ if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
+ spin_unlock_bh(&np->np_thread_lock);
+- pr_err("iSCSI Network Portal on %s:%hu currently not"
+- " active.\n", np->np_ip, np->np_port);
++ pr_err("iSCSI Network Portal on %pISc:%hu currently not"
++ " active.\n", &np->np_sockaddr, np->np_port);
+ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+ ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE);
+ goto new_sess_out;
+--- a/drivers/target/iscsi/iscsi_target_tpg.c
++++ b/drivers/target/iscsi/iscsi_target_tpg.c
+@@ -460,7 +460,6 @@ static bool iscsit_tpg_check_network_por
+ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
+ struct iscsi_portal_group *tpg,
+ struct __kernel_sockaddr_storage *sockaddr,
+- char *ip_str,
+ struct iscsi_tpg_np *tpg_np_parent,
+ int network_transport)
+ {
+@@ -470,8 +469,8 @@ struct iscsi_tpg_np *iscsit_tpg_add_netw
+ if (!tpg_np_parent) {
+ if (iscsit_tpg_check_network_portal(tpg->tpg_tiqn, sockaddr,
+ network_transport)) {
+- pr_err("Network Portal: %s already exists on a"
+- " different TPG on %s\n", ip_str,
++ pr_err("Network Portal: %pISc already exists on a"
++ " different TPG on %s\n", sockaddr,
+ tpg->tpg_tiqn->tiqn);
+ return ERR_PTR(-EEXIST);
+ }
+@@ -484,7 +483,7 @@ struct iscsi_tpg_np *iscsit_tpg_add_netw
+ return ERR_PTR(-ENOMEM);
+ }
+
+- np = iscsit_add_np(sockaddr, ip_str, network_transport);
++ np = iscsit_add_np(sockaddr, network_transport);
+ if (IS_ERR(np)) {
+ kfree(tpg_np);
+ return ERR_CAST(np);
+@@ -514,8 +513,8 @@ struct iscsi_tpg_np *iscsit_tpg_add_netw
+ spin_unlock(&tpg_np_parent->tpg_np_parent_lock);
+ }
+
+- pr_debug("CORE[%s] - Added Network Portal: %s:%hu,%hu on %s\n",
+- tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt,
++ pr_debug("CORE[%s] - Added Network Portal: %pISc:%hu,%hu on %s\n",
++ tpg->tpg_tiqn->tiqn, &np->np_sockaddr, np->np_port, tpg->tpgt,
+ np->np_transport->name);
+
+ return tpg_np;
+@@ -528,8 +527,8 @@ static int iscsit_tpg_release_np(
+ {
+ iscsit_clear_tpg_np_login_thread(tpg_np, tpg, true);
+
+- pr_debug("CORE[%s] - Removed Network Portal: %s:%hu,%hu on %s\n",
+- tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt,
++ pr_debug("CORE[%s] - Removed Network Portal: %pISc:%hu,%hu on %s\n",
++ tpg->tpg_tiqn->tiqn, &np->np_sockaddr, np->np_port, tpg->tpgt,
+ np->np_transport->name);
+
+ tpg_np->tpg_np = NULL;
+--- a/drivers/target/iscsi/iscsi_target_tpg.h
++++ b/drivers/target/iscsi/iscsi_target_tpg.h
+@@ -22,7 +22,7 @@ extern struct iscsi_node_attrib *iscsit_
+ extern void iscsit_tpg_del_external_nps(struct iscsi_tpg_np *);
+ extern struct iscsi_tpg_np *iscsit_tpg_locate_child_np(struct iscsi_tpg_np *, int);
+ extern struct iscsi_tpg_np *iscsit_tpg_add_network_portal(struct iscsi_portal_group *,
+- struct __kernel_sockaddr_storage *, char *, struct iscsi_tpg_np *,
++ struct __kernel_sockaddr_storage *, struct iscsi_tpg_np *,
+ int);
+ extern int iscsit_tpg_del_network_portal(struct iscsi_portal_group *,
+ struct iscsi_tpg_np *);
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -776,7 +776,6 @@ struct iscsi_np {
+ enum iscsi_timer_flags_table np_login_timer_flags;
+ u32 np_exports;
+ enum np_flags_table np_flags;
+- unsigned char np_ip[IPV6_ADDRESS_SPACE];
+ u16 np_port;
+ spinlock_t np_thread_lock;
+ struct completion np_restart_comp;
projects / thirdparty / kernel / stable-queue.git / commitdiff
