--- /dev/null
+From 788fff0fdfb9ffcd7d75d3cfac0aaa550c182fec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 09:59:28 -0500
+Subject: Revert "scsi: target: iscsi: cxgbit: fix csk leak"
+
+This reverts commit c9cef2c71a89a2c926dae8151f9497e72f889315.
+
+A wrong commit message was used for the stable commit because of a human
+error (and duplicate commit subject lines).
+
+This patch reverts this error, and the following patches add the two
+upstream commits.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+index b289b90ae6dc..8de16016b6de 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+@@ -631,11 +631,8 @@ static void cxgbit_send_halfclose(struct cxgbit_sock *csk)
+
+ static void cxgbit_arp_failure_discard(void *handle, struct sk_buff *skb)
+ {
+- struct cxgbit_sock *csk = handle;
+-
+ pr_debug("%s cxgbit_device %p\n", __func__, handle);
+ kfree_skb(skb);
+- cxgbit_put_csk(csk);
+ }
+
+ static void cxgbit_abort_arp_failure(void *handle, struct sk_buff *skb)
+@@ -1193,7 +1190,7 @@ cxgbit_pass_accept_rpl(struct cxgbit_sock *csk, struct cpl_pass_accept_req *req)
+ rpl5->opt0 = cpu_to_be64(opt0);
+ rpl5->opt2 = cpu_to_be32(opt2);
+ set_wr_txq(skb, CPL_PRIORITY_SETUP, csk->ctrlq_idx);
+- t4_set_arp_err_handler(skb, csk, cxgbit_arp_failure_discard);
++ t4_set_arp_err_handler(skb, NULL, cxgbit_arp_failure_discard);
+ cxgbit_l2t_send(csk->com.cdev, skb, csk->l2t);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 2162a7be0a9e55f1f03c2d58fcce0a8de9771604 Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Wed, 19 Sep 2018 19:44:57 +0530
+Subject: scsi: target: iscsi: cxgbit: fix csk leak
+
+[ Upstream commit 801df68d617e3cb831f531c99fa6003620e6b343 ]
+
+csk leak can happen if a new TCP connection gets established after
+cxgbit_accept_np() returns, to fix this leak free remaining csk in
+cxgbit_free_np().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/cxgbit/cxgbit_cm.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+index 8de16016b6de..71888b979ab5 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+@@ -598,9 +598,12 @@ static void cxgbit_free_cdev_np(struct cxgbit_np *cnp)
+ mutex_unlock(&cdev_list_lock);
+ }
+
++static void __cxgbit_free_conn(struct cxgbit_sock *csk);
++
+ void cxgbit_free_np(struct iscsi_np *np)
+ {
+ struct cxgbit_np *cnp = np->np_context;
++ struct cxgbit_sock *csk, *tmp;
+
+ cnp->com.state = CSK_STATE_DEAD;
+ if (cnp->com.cdev)
+@@ -608,6 +611,13 @@ void cxgbit_free_np(struct iscsi_np *np)
+ else
+ cxgbit_free_all_np(cnp);
+
++ spin_lock_bh(&cnp->np_accept_lock);
++ list_for_each_entry_safe(csk, tmp, &cnp->np_accept_list, accept_node) {
++ list_del_init(&csk->accept_node);
++ __cxgbit_free_conn(csk);
++ }
++ spin_unlock_bh(&cnp->np_accept_lock);
++
+ np->np_context = NULL;
+ cxgbit_put_cnp(cnp);
+ }
+@@ -705,9 +715,9 @@ void cxgbit_abort_conn(struct cxgbit_sock *csk)
+ csk->tid, 600, __func__);
+ }
+
+-void cxgbit_free_conn(struct iscsi_conn *conn)
++static void __cxgbit_free_conn(struct cxgbit_sock *csk)
+ {
+- struct cxgbit_sock *csk = conn->context;
++ struct iscsi_conn *conn = csk->conn;
+ bool release = false;
+
+ pr_debug("%s: state %d\n",
+@@ -716,7 +726,7 @@ void cxgbit_free_conn(struct iscsi_conn *conn)
+ spin_lock_bh(&csk->lock);
+ switch (csk->com.state) {
+ case CSK_STATE_ESTABLISHED:
+- if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
++ if (conn && (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)) {
+ csk->com.state = CSK_STATE_CLOSING;
+ cxgbit_send_halfclose(csk);
+ } else {
+@@ -741,6 +751,11 @@ void cxgbit_free_conn(struct iscsi_conn *conn)
+ cxgbit_put_csk(csk);
+ }
+
++void cxgbit_free_conn(struct iscsi_conn *conn)
++{
++ __cxgbit_free_conn(conn->context);
++}
++
+ static void cxgbit_set_emss(struct cxgbit_sock *csk, u16 opt)
+ {
+ csk->emss = csk->com.cdev->lldi.mtus[TCPOPT_MSS_G(opt)] -
+@@ -803,6 +818,7 @@ void _cxgbit_free_csk(struct kref *kref)
+ spin_unlock_bh(&cdev->cskq.lock);
+
+ cxgbit_free_skb(csk);
++ cxgbit_put_cnp(csk->cnp);
+ cxgbit_put_cdev(cdev);
+
+ kfree(csk);
+@@ -1351,6 +1367,7 @@ cxgbit_pass_accept_req(struct cxgbit_device *cdev, struct sk_buff *skb)
+ goto rel_skb;
+ }
+
++ cxgbit_get_cnp(cnp);
+ cxgbit_get_cdev(cdev);
+
+ spin_lock(&cdev->cskq.lock);
+--
+2.19.1
+
--- /dev/null
+From 26f4d85bbf1a99d2be5563dc425bcc0ff701008c Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Fri, 9 Nov 2018 20:59:01 +0530
+Subject: scsi: target: iscsi: cxgbit: fix csk leak
+
+[ Upstream commit ed076c55b359cc9982ca8b065bcc01675f7365f6 ]
+
+In case of arp failure call cxgbit_put_csk() to free csk.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/cxgbit/cxgbit_cm.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+index 71888b979ab5..b19c960d5490 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+@@ -641,8 +641,11 @@ static void cxgbit_send_halfclose(struct cxgbit_sock *csk)
+
+ static void cxgbit_arp_failure_discard(void *handle, struct sk_buff *skb)
+ {
++ struct cxgbit_sock *csk = handle;
++
+ pr_debug("%s cxgbit_device %p\n", __func__, handle);
+ kfree_skb(skb);
++ cxgbit_put_csk(csk);
+ }
+
+ static void cxgbit_abort_arp_failure(void *handle, struct sk_buff *skb)
+@@ -1206,7 +1209,7 @@ cxgbit_pass_accept_rpl(struct cxgbit_sock *csk, struct cpl_pass_accept_req *req)
+ rpl5->opt0 = cpu_to_be64(opt0);
+ rpl5->opt2 = cpu_to_be32(opt2);
+ set_wr_txq(skb, CPL_PRIORITY_SETUP, csk->ctrlq_idx);
+- t4_set_arp_err_handler(skb, NULL, cxgbit_arp_failure_discard);
++ t4_set_arp_err_handler(skb, csk, cxgbit_arp_failure_discard);
+ cxgbit_l2t_send(csk->com.cdev, skb, csk->l2t);
+ }
+
+--
+2.19.1
+
netfilter-nf_conncount-speculative-garbage-collection-on-empty-lists.patch
netfilter-nf_conncount-fix-argument-order-to-find_next_bit.patch
mmc-sdhci-msm-disable-cdr-function-on-tx.patch
+revert-scsi-target-iscsi-cxgbit-fix-csk-leak.patch
+scsi-target-iscsi-cxgbit-fix-csk-leak-1.patch
+scsi-target-iscsi-cxgbit-fix-csk-leak-2.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
