From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 20 Jan 2015 08:37:40 +0000 (+0800)
Subject: 3.10-stable patches
X-Git-Tag: v3.10.66~42
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0ba22093c76c524e3dbed800ee84f0c2e7c4586f;p=thirdparty%2Fkernel%2Fstable-queue.git

3.10-stable patches

added patches:
	iscsi-target-fail-connection-on-short-sendmsg-writes.patch
---

diff --git a/queue-3.10/iscsi-target-fail-connection-on-short-sendmsg-writes.patch b/queue-3.10/iscsi-target-fail-connection-on-short-sendmsg-writes.patch
new file mode 100644
index 00000000000..8790a581e46
--- /dev/null
+++ b/queue-3.10/iscsi-target-fail-connection-on-short-sendmsg-writes.patch
@@ -0,0 +1,86 @@
+From 6bf6ca7515c1df06f5c03737537f5e0eb191e29e Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 20 Nov 2014 20:50:07 -0800
+Subject: iscsi-target: Fail connection on short sendmsg writes
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 6bf6ca7515c1df06f5c03737537f5e0eb191e29e upstream.
+
+This patch changes iscsit_do_tx_data() to fail on short writes
+when kernel_sendmsg() returns a value different than requested
+transfer length, returning -EPIPE and thus causing a connection
+reset to occur.
+
+This avoids a potential bug in the original code where a short
+write would result in kernel_sendmsg() being called again with
+the original iovec base + length.
+
+In practice this has not been an issue because iscsit_do_tx_data()
+is only used for transferring 48 byte headers + 4 byte digests,
+along with seldom used control payloads from NOPIN + TEXT_RSP +
+REJECT with less than 32k of data.
+
+So following Al's audit of iovec consumers, go ahead and fail
+the connection on short writes for now, and remove the bogus
+logic ahead of his proper upstream fix.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target_util.c |   26 +++++++++++---------------
+ 1 file changed, 11 insertions(+), 15 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -1349,15 +1349,15 @@ static int iscsit_do_tx_data(
+ 	struct iscsi_conn *conn,
+ 	struct iscsi_data_count *count)
+ {
+-	int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
++	int ret, iov_len;
+ 	struct kvec *iov_p;
+ 	struct msghdr msg;
+ 
+ 	if (!conn || !conn->sock || !conn->conn_ops)
+ 		return -1;
+ 
+-	if (data <= 0) {
+-		pr_err("Data length is: %d\n", data);
++	if (count->data_length <= 0) {
++		pr_err("Data length is: %d\n", count->data_length);
+ 		return -1;
+ 	}
+ 
+@@ -1366,20 +1366,16 @@ static int iscsit_do_tx_data(
+ 	iov_p = count->iov;
+ 	iov_len = count->iov_count;
+ 
+-	while (total_tx < data) {
+-		tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
+-					(data - total_tx));
+-		if (tx_loop <= 0) {
+-			pr_debug("tx_loop: %d total_tx %d\n",
+-				tx_loop, total_tx);
+-			return tx_loop;
+-		}
+-		total_tx += tx_loop;
+-		pr_debug("tx_loop: %d, total_tx: %d, data: %d\n",
+-					tx_loop, total_tx, data);
++	ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
++			     count->data_length);
++	if (ret != count->data_length) {
++		pr_err("Unexpected ret: %d send data %d\n",
++		       ret, count->data_length);
++		return -EPIPE;
+ 	}
++	pr_debug("ret: %d, sent data: %d\n", ret, count->data_length);
+ 
+-	return total_tx;
++	return ret;
+ }
+ 
+ int rx_data(
diff --git a/queue-3.10/series b/queue-3.10/series
index f338b542b8a..8068fbca805 100644
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -13,3 +13,4 @@ arc-move-peripherals-to-match-model-to-fpga.patch
 cfg80211-fix-160-mhz-channels-with-80-80-and-160-mhz-drivers.patch
 rtlwifi-rtl8192ce-set-fw_ready-flag.patch
 hp_accel-add-support-for-hp-zbook-15.patch
+iscsi-target-fail-connection-on-short-sendmsg-writes.patch