linux.git/include/target, branch v5.4.63

scsi: target: fix hang when multiple threads try to destroy the same iscsi session

2020-04-21T07:05:04+00:00

[ Upstream commit 57c46e9f33da530a2485fa01aa27b6d18c28c796 ]

A number of hangs have been reported against the target driver; they are
due to the fact that multiple threads may try to destroy the iscsi session
at the same time. This may be reproduced for example when a "targetcli
iscsi/iqn.../tpg1 disable" command is executed while a logout operation is
underway.

When this happens, two or more threads may end up sleeping and waiting for
iscsit_close_connection() to execute "complete(session_wait_comp)".  Only
one of the threads will wake up and proceed to destroy the session
structure, the remaining threads will hang forever.

Note that if the blocked threads are somehow forced to wake up with
complete_all(), they will try to free the same iscsi session structure
destroyed by the first thread, causing double frees, memory corruptions
etc...

With this patch, the threads that want to destroy the iscsi session will
increase the session refcount and will set the "session_close" flag to 1;
then they wait for the driver to close the remaining active connections.
When the last connection is closed, iscsit_close_connection() will wake up
all the threads and will wait for the session's refcount to reach zero;
when this happens, iscsit_close_connection() will destroy the session
structure because no one is referencing it anymore.

 INFO: task targetcli:5971 blocked for more than 120 seconds.
       Tainted: P           OE    4.15.0-72-generic #81~16.04.1
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 targetcli       D    0  5971      1 0x00000080
 Call Trace:
  __schedule+0x3d6/0x8b0
  ? vprintk_func+0x44/0xe0
  schedule+0x36/0x80
  schedule_timeout+0x1db/0x370
  ? __dynamic_pr_debug+0x8a/0xb0
  wait_for_completion+0xb4/0x140
  ? wake_up_q+0x70/0x70
  iscsit_free_session+0x13d/0x1a0 [iscsi_target_mod]
  iscsit_release_sessions_for_tpg+0x16b/0x1e0 [iscsi_target_mod]
  iscsit_tpg_disable_portal_group+0xca/0x1c0 [iscsi_target_mod]
  lio_target_tpg_enable_store+0x66/0xe0 [iscsi_target_mod]
  configfs_write_file+0xb9/0x120
  __vfs_write+0x1b/0x40
  vfs_write+0xb8/0x1b0
  SyS_write+0x5c/0xe0
  do_syscall_64+0x73/0x130
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2

Link: https://lore.kernel.org/r/20200313170656.9716-3-mlombard@redhat.com
Reported-by: Matt Coleman 
Tested-by: Matt Coleman 
Tested-by: Rahul Kundu 
Signed-off-by: Maurizio Lombardi 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: target/iscsi: Handle too large immediate data buffers correctly

2019-04-13T00:20:06+00:00

Since target_alloc_sgl() and iscsit_allocate_iovecs() allocate buffer space
for se_cmd.data_length bytes and since that number can be smaller than the
iSCSI Expected Data Transfer Length (EDTL), ensure that the iSCSI target
driver does not attempt to receive more bytes than what fits in the receive
buffer. Always receive the full immediate data buffer such that the iSCSI
target driver does not attempt to parse immediate data as an iSCSI PDU.

Note: the current code base only calls iscsit_get_dataout() if the size of
the immediate data buffer does not exceed the buffer size derived from the
SCSI CDB. See also target_cmd_size_check().

Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Nicholas Bellinger 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Rework the SPC-2 reservation handling code

2019-04-13T00:20:05+00:00

Instead of tracking the initiator that established an SPC-2 reservation,
track the session through which the SPC-2 reservation has been
established. This patch does not change any functionality.

Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Nicholas Bellinger 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/iscsi: Rename a function and a function pointer

2019-02-05T02:34:49+00:00

Having both a function and a function pointer member with the same
name (iscsit_release_cmd) is confusing. Hence rename the function pointer
member.

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/iscsi: Fix spelling of "unsolicited"

2019-02-05T02:33:59+00:00

Change "unsoliticed" into "unsolicited".

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Sagi Grimberg 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Add target_send_busy()

2019-02-05T02:28:48+00:00

Introduce a function that sends the SCSI status "BUSY" back to the
initiator. The next patch will add a call to this function in the srpt
target driver.

Reviewed-by: Hannes Reinecke 
Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Remove several state tests from the TMF code

2019-02-05T02:25:13+00:00

Whether or not a session is being torn down does not affect whether or not
SCSI commands are in the task set. Hence remove the "tearing down" checks
from the TMF code. The TRANSPORT_ISTATE_PROCESSING check is left out
because it is now safe to wait for a command that is in that state. The
CMD_T_PRE_EXECUTE is left out because abort processing is postponed until
after commands have left the pre-execute state since the patch that makes
TMF processing synchronous.

See also commit 1c21a48055a6 ("target: Avoid early CMD_T_PRE_EXECUTE
failures during ABORT_TASK").

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Remove the write_pending_status() callback function

2019-02-05T02:23:59+00:00

Due to the patch that makes TMF handling synchronous the
write_pending_status() callback function is no longer called.  Hence remove
it.

Acked-by: Felipe Balbi 
Reviewed-by: Sagi Grimberg 
Reviewed-by: Andy Grover 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Reviewed-by: Bryant G. Ly 
Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Himanshu Madhani 
Cc: Quinn Tran 
Cc: Saurav Kashyap 
Cc: Michael S. Tsirkin 
Cc: Juergen Gross 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target: consistently null-terminate t10_wwn strings

2018-12-08T02:54:33+00:00

In preparation for supporting user provided vendor strings, add an extra
byte to the vendor, model and revision arrays in struct t10_wwn. This
ensures that the full INQUIRY data can be carried in the arrays along with
a null-terminator.

Change a number of array readers and writers so that they account for
explicit null-termination:

- The pscsi_set_inquiry_info() and emulate_model_alias_store() codepaths
  don't currently explicitly null-terminate; fix this.

- Existing t10_wwn field dumps use for-loops which step over
  null-terminators for right-padding.
  + Use printf with width specifiers instead.

Signed-off-by: David Disseldorp 
Reviewed-by: Roman Bolshakov 
Signed-off-by: Martin K. Petersen

scsi: target/core: Make ABORT and LUN RESET handling synchronous

2018-12-08T02:22:55+00:00

Instead of invoking target driver callback functions from the context that
handles an abort or LUN RESET task management function, only set the abort
flag from that context and perform the actual abort handling from the
context of the regular command processing flow. This approach has the
advantage that the task management code becomes much easier to read and to
verify since the number of potential race conditions against the command
processing flow is strongly reduced.

This patch has been tested by running the following two shell commands
concurrently for about ten minutes for both the iSCSI and the SRP target
drivers ($dev is an initiator device node connected with storage provided
by the target driver under test):

 * fio with data verification enabled on a filesystem mounted on top of
   $dev.

 * while true; do sg_reset -d $dev; echo -n .; sleep .1; done

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: David Disseldorp 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen