From: Greg Kroah-Hartman Date: Wed, 2 Jul 2014 20:44:55 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.4.97~41 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2975fbf80c74187b9e8f9188c3d6189f5506eedf;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: iscsi-target-avoid-rejecting-incorrect-itt-for-data-out.patch iscsi-target-explicily-clear-login-response-pdu-in-exception-path.patch target-fix-left-over-se_lun-lun_sep-pointer-oops.patch --- diff --git a/queue-3.10/iscsi-target-avoid-rejecting-incorrect-itt-for-data-out.patch b/queue-3.10/iscsi-target-avoid-rejecting-incorrect-itt-for-data-out.patch new file mode 100644 index 00000000000..a0ba1083946 --- /dev/null +++ b/queue-3.10/iscsi-target-avoid-rejecting-incorrect-itt-for-data-out.patch @@ -0,0 +1,38 @@ +From 97c99b47ac58bacb7c09e1f47d5d184434f6b06a Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Fri, 20 Jun 2014 10:59:57 -0700 +Subject: iscsi-target: Avoid rejecting incorrect ITT for Data-Out + +From: Nicholas Bellinger + +commit 97c99b47ac58bacb7c09e1f47d5d184434f6b06a upstream. + +This patch changes iscsit_check_dataout_hdr() to dump the incoming +Data-Out payload when the received ITT is not associated with a +WRITE, instead of calling iscsit_reject_cmd() for the non WRITE +ITT descriptor. + +This addresses a bug where an initiator sending an Data-Out for +an ITT associated with a READ would end up generating a reject +for the READ, eventually resulting in list corruption. + +Reported-by: Santosh Kulkarni +Reported-by: Arshad Hussain +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1313,7 +1313,7 @@ iscsit_check_dataout_hdr(struct iscsi_co + if (cmd->data_direction != DMA_TO_DEVICE) { + pr_err("Command ITT: 0x%08x received DataOUT for a" + " NON-WRITE command.\n", cmd->init_task_tag); +- return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf); ++ return iscsit_dump_data_payload(conn, payload_length, 1); + } + se_cmd = &cmd->se_cmd; + iscsit_mod_dataout_timer(cmd); diff --git a/queue-3.10/iscsi-target-explicily-clear-login-response-pdu-in-exception-path.patch b/queue-3.10/iscsi-target-explicily-clear-login-response-pdu-in-exception-path.patch new file mode 100644 index 00000000000..eb207b6f9a8 --- /dev/null +++ b/queue-3.10/iscsi-target-explicily-clear-login-response-pdu-in-exception-path.patch @@ -0,0 +1,37 @@ +From 683497566d48f86e04d026de1ee658dd74fc1077 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Tue, 17 Jun 2014 21:54:38 +0000 +Subject: iscsi-target: Explicily clear login response PDU in exception path + +From: Nicholas Bellinger + +commit 683497566d48f86e04d026de1ee658dd74fc1077 upstream. + +This patch adds a explicit memset to the login response PDU +exception path in iscsit_tx_login_rsp(). + +This addresses a regression bug introduced in commit baa4d64b +where the initiator would end up not receiving the login +response and associated status class + detail, before closing +the login connection. + +Reported-by: Christophe Vu-Brugier +Tested-by: Christophe Vu-Brugier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_util.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -1288,6 +1288,8 @@ int iscsit_tx_login_rsp(struct iscsi_con + login->login_failed = 1; + iscsit_collect_login_stats(conn, status_class, status_detail); + ++ memset(&login->rsp[0], 0, ISCSI_HDR_LEN); ++ + hdr = (struct iscsi_login_rsp *)&login->rsp[0]; + hdr->opcode = ISCSI_OP_LOGIN_RSP; + hdr->status_class = status_class; diff --git a/queue-3.10/series b/queue-3.10/series new file mode 100644 index 00000000000..b29674ab4ad --- /dev/null +++ b/queue-3.10/series @@ -0,0 +1,3 @@ +target-fix-left-over-se_lun-lun_sep-pointer-oops.patch +iscsi-target-avoid-rejecting-incorrect-itt-for-data-out.patch +iscsi-target-explicily-clear-login-response-pdu-in-exception-path.patch diff --git a/queue-3.10/target-fix-left-over-se_lun-lun_sep-pointer-oops.patch b/queue-3.10/target-fix-left-over-se_lun-lun_sep-pointer-oops.patch new file mode 100644 index 00000000000..ab51b25077e --- /dev/null +++ b/queue-3.10/target-fix-left-over-se_lun-lun_sep-pointer-oops.patch @@ -0,0 +1,36 @@ +From 83ff42fcce070801a3aa1cd6a3269d7426271a8d Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Mon, 16 Jun 2014 20:25:54 +0000 +Subject: target: Fix left-over se_lun->lun_sep pointer OOPs + +From: Nicholas Bellinger + +commit 83ff42fcce070801a3aa1cd6a3269d7426271a8d upstream. + +This patch fixes a left-over se_lun->lun_sep pointer OOPs when one +of the /sys/kernel/config/target/$FABRIC/$WWPN/$TPGT/lun/$LUN/alua* +attributes is accessed after the $DEVICE symlink has been removed. + +To address this bug, go ahead and clear se_lun->lun_sep memory in +core_dev_unexport(), so that the existing checks for show/store +ALUA attributes in target_core_fabric_configfs.c work as expected. + +Reported-by: Sebastian Herbszt +Tested-by: Sebastian Herbszt +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_device.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -614,6 +614,7 @@ void core_dev_unexport( + dev->export_count--; + spin_unlock(&hba->device_lock); + ++ lun->lun_sep = NULL; + lun->lun_se_dev = NULL; + } + diff --git a/queue-3.14/series b/queue-3.14/series index 82df2f9f4d1..372605c1420 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -1 +1,5 @@ arm-dts-disable-mdma1-node-for-exynos5420.patch +target-fix-left-over-se_lun-lun_sep-pointer-oops.patch +iscsi-target-avoid-rejecting-incorrect-itt-for-data-out.patch +iscsi-target-explicily-clear-login-response-pdu-in-exception-path.patch +iscsi-target-fix-iscsit_del_np-deadlock-on-unload.patch diff --git a/queue-3.15/series b/queue-3.15/series new file mode 100644 index 00000000000..662c79dc2aa --- /dev/null +++ b/queue-3.15/series @@ -0,0 +1,4 @@ +target-fix-left-over-se_lun-lun_sep-pointer-oops.patch +iscsi-target-avoid-rejecting-incorrect-itt-for-data-out.patch +iscsi-target-explicily-clear-login-response-pdu-in-exception-path.patch +iscsi-target-fix-iscsit_del_np-deadlock-on-unload.patch diff --git a/queue-3.4/series b/queue-3.4/series new file mode 100644 index 00000000000..e69de29bb2d