Skip to content

Commit aeb5427

Browse files
torvaldstorvalds
committed
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley: "Three fixes, all in drivers (qedi and iscsi target) so no wider impact even if the code changes are a bit extensive" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qedi: Add the CRC size within iSCSI NVM image scsi: iscsi: target: Fix conn_ops double free scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values fails
2 parents 5e33554 + c77a2fa commit aeb5427

File tree

5 files changed

+101
-94
lines changed

5 files changed

+101
-94
lines changed

‎drivers/scsi/qedi/qedi.h

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,11 @@ enum qedi_nvm_tgts {
7777
QEDI_NVM_TGT_SEC,
7878
};
7979

80+
struct qedi_nvm_iscsi_image {
81+
struct nvm_iscsi_cfg iscsi_cfg;
82+
u32 crc;
83+
};
84+
8085
struct qedi_uio_ctrl {
8186
/* meta data */
8287
u32 uio_hsi_version;
@@ -294,7 +299,7 @@ struct qedi_ctx {
294299
void *bdq_pbl_list;
295300
dma_addr_t bdq_pbl_list_dma;
296301
u8 bdq_pbl_list_num_entries;
297-
struct nvm_iscsi_cfg *iscsi_cfg;
302+
struct qedi_nvm_iscsi_image *iscsi_image;
298303
dma_addr_t nvm_buf_dma;
299304
void __iomem *bdq_primary_prod;
300305
void __iomem *bdq_secondary_prod;

‎drivers/scsi/qedi/qedi_main.c

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1346,23 +1346,26 @@ static int qedi_setup_int(struct qedi_ctx *qedi)
13461346

13471347
static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi)
13481348
{
1349-
if (qedi->iscsi_cfg)
1349+
if (qedi->iscsi_image)
13501350
dma_free_coherent(&qedi->pdev->dev,
1351-
sizeof(struct nvm_iscsi_cfg),
1352-
qedi->iscsi_cfg, qedi->nvm_buf_dma);
1351+
sizeof(struct qedi_nvm_iscsi_image),
1352+
qedi->iscsi_image, qedi->nvm_buf_dma);
13531353
}
13541354

13551355
static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi)
13561356
{
1357-
qedi->iscsi_cfg = dma_zalloc_coherent(&qedi->pdev->dev,
1358-
sizeof(struct nvm_iscsi_cfg),
1359-
&qedi->nvm_buf_dma, GFP_KERNEL);
1360-
if (!qedi->iscsi_cfg) {
1357+
struct qedi_nvm_iscsi_image nvm_image;
1358+
1359+
qedi->iscsi_image = dma_zalloc_coherent(&qedi->pdev->dev,
1360+
sizeof(nvm_image),
1361+
&qedi->nvm_buf_dma,
1362+
GFP_KERNEL);
1363+
if (!qedi->iscsi_image) {
13611364
QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n");
13621365
return -ENOMEM;
13631366
}
13641367
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
1365-
"NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_cfg,
1368+
"NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_image,
13661369
qedi->nvm_buf_dma);
13671370

13681371
return 0;
@@ -1905,7 +1908,7 @@ qedi_get_nvram_block(struct qedi_ctx *qedi)
19051908
struct nvm_iscsi_block *block;
19061909

19071910
pf = qedi->dev_info.common.abs_pf_id;
1908-
block = &qedi->iscsi_cfg->block[0];
1911+
block = &qedi->iscsi_image->iscsi_cfg.block[0];
19091912
for (i = 0; i < NUM_OF_ISCSI_PF_SUPPORTED; i++, block++) {
19101913
flags = ((block->id) & NVM_ISCSI_CFG_BLK_CTRL_FLAG_MASK) >>
19111914
NVM_ISCSI_CFG_BLK_CTRL_FLAG_OFFSET;
@@ -2194,15 +2197,14 @@ static void qedi_boot_release(void *data)
21942197
static int qedi_get_boot_info(struct qedi_ctx *qedi)
21952198
{
21962199
int ret = 1;
2197-
u16 len;
2198-
2199-
len = sizeof(struct nvm_iscsi_cfg);
2200+
struct qedi_nvm_iscsi_image nvm_image;
22002201

22012202
QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
22022203
"Get NVM iSCSI CFG image\n");
22032204
ret = qedi_ops->common->nvm_get_image(qedi->cdev,
22042205
QED_NVM_IMAGE_ISCSI_CFG,
2205-
(char *)qedi->iscsi_cfg, len);
2206+
(char *)qedi->iscsi_image,
2207+
sizeof(nvm_image));
22062208
if (ret)
22072209
QEDI_ERR(&qedi->dbg_ctx,
22082210
"Could not get NVM image. ret = %d\n", ret);

‎drivers/target/iscsi/iscsi_target.c

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4208,22 +4208,15 @@ int iscsit_close_connection(
42084208
crypto_free_ahash(tfm);
42094209
}
42104210

4211-
free_cpumask_var(conn->conn_cpumask);
4212-
4213-
kfree(conn->conn_ops);
4214-
conn->conn_ops = NULL;
4215-
42164211
if (conn->sock)
42174212
sock_release(conn->sock);
42184213

42194214
if (conn->conn_transport->iscsit_free_conn)
42204215
conn->conn_transport->iscsit_free_conn(conn);
42214216

4222-
iscsit_put_transport(conn->conn_transport);
4223-
42244217
pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
42254218
conn->conn_state = TARG_CONN_STATE_FREE;
4226-
kfree(conn);
4219+
iscsit_free_conn(conn);
42274220

42284221
spin_lock_bh(&sess->conn_lock);
42294222
atomic_dec(&sess->nconn);

‎drivers/target/iscsi/iscsi_target_login.c

Lines changed: 78 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -67,45 +67,10 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
6767
goto out_req_buf;
6868
}
6969

70-
conn->conn_ops = kzalloc(sizeof(struct iscsi_conn_ops), GFP_KERNEL);
71-
if (!conn->conn_ops) {
72-
pr_err("Unable to allocate memory for"
73-
" struct iscsi_conn_ops.\n");
74-
goto out_rsp_buf;
75-
}
76-
77-
init_waitqueue_head(&conn->queues_wq);
78-
INIT_LIST_HEAD(&conn->conn_list);
79-
INIT_LIST_HEAD(&conn->conn_cmd_list);
80-
INIT_LIST_HEAD(&conn->immed_queue_list);
81-
INIT_LIST_HEAD(&conn->response_queue_list);
82-
init_completion(&conn->conn_post_wait_comp);
83-
init_completion(&conn->conn_wait_comp);
84-
init_completion(&conn->conn_wait_rcfr_comp);
85-
init_completion(&conn->conn_waiting_on_uc_comp);
86-
init_completion(&conn->conn_logout_comp);
87-
init_completion(&conn->rx_half_close_comp);
88-
init_completion(&conn->tx_half_close_comp);
89-
init_completion(&conn->rx_login_comp);
90-
spin_lock_init(&conn->cmd_lock);
91-
spin_lock_init(&conn->conn_usage_lock);
92-
spin_lock_init(&conn->immed_queue_lock);
93-
spin_lock_init(&conn->nopin_timer_lock);
94-
spin_lock_init(&conn->response_queue_lock);
95-
spin_lock_init(&conn->state_lock);
96-
97-
if (!zalloc_cpumask_var(&conn->conn_cpumask, GFP_KERNEL)) {
98-
pr_err("Unable to allocate conn->conn_cpumask\n");
99-
goto out_conn_ops;
100-
}
10170
conn->conn_login = login;
10271

10372
return login;
10473

105-
out_conn_ops:
106-
kfree(conn->conn_ops);
107-
out_rsp_buf:
108-
kfree(login->rsp_buf);
10974
out_req_buf:
11075
kfree(login->req_buf);
11176
out_login:
@@ -310,11 +275,9 @@ static int iscsi_login_zero_tsih_s1(
310275
return -ENOMEM;
311276
}
312277

313-
ret = iscsi_login_set_conn_values(sess, conn, pdu->cid);
314-
if (unlikely(ret)) {
315-
kfree(sess);
316-
return ret;
317-
}
278+
if (iscsi_login_set_conn_values(sess, conn, pdu->cid))
279+
goto free_sess;
280+
318281
sess->init_task_tag = pdu->itt;
319282
memcpy(&sess->isid, pdu->isid, 6);
320283
sess->exp_cmd_sn = be32_to_cpu(pdu->cmdsn);
@@ -1149,6 +1112,75 @@ iscsit_conn_set_transport(struct iscsi_conn *conn, struct iscsit_transport *t)
11491112
return 0;
11501113
}
11511114

1115+
static struct iscsi_conn *iscsit_alloc_conn(struct iscsi_np *np)
1116+
{
1117+
struct iscsi_conn *conn;
1118+
1119+
conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
1120+
if (!conn) {
1121+
pr_err("Could not allocate memory for new connection\n");
1122+
return NULL;
1123+
}
1124+
pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
1125+
conn->conn_state = TARG_CONN_STATE_FREE;
1126+
1127+
init_waitqueue_head(&conn->queues_wq);
1128+
INIT_LIST_HEAD(&conn->conn_list);
1129+
INIT_LIST_HEAD(&conn->conn_cmd_list);
1130+
INIT_LIST_HEAD(&conn->immed_queue_list);
1131+
INIT_LIST_HEAD(&conn->response_queue_list);
1132+
init_completion(&conn->conn_post_wait_comp);
1133+
init_completion(&conn->conn_wait_comp);
1134+
init_completion(&conn->conn_wait_rcfr_comp);
1135+
init_completion(&conn->conn_waiting_on_uc_comp);
1136+
init_completion(&conn->conn_logout_comp);
1137+
init_completion(&conn->rx_half_close_comp);
1138+
init_completion(&conn->tx_half_close_comp);
1139+
init_completion(&conn->rx_login_comp);
1140+
spin_lock_init(&conn->cmd_lock);
1141+
spin_lock_init(&conn->conn_usage_lock);
1142+
spin_lock_init(&conn->immed_queue_lock);
1143+
spin_lock_init(&conn->nopin_timer_lock);
1144+
spin_lock_init(&conn->response_queue_lock);
1145+
spin_lock_init(&conn->state_lock);
1146+
1147+
timer_setup(&conn->nopin_response_timer,
1148+
iscsit_handle_nopin_response_timeout, 0);
1149+
timer_setup(&conn->nopin_timer, iscsit_handle_nopin_timeout, 0);
1150+
1151+
if (iscsit_conn_set_transport(conn, np->np_transport) < 0)
1152+
goto free_conn;
1153+
1154+
conn->conn_ops = kzalloc(sizeof(struct iscsi_conn_ops), GFP_KERNEL);
1155+
if (!conn->conn_ops) {
1156+
pr_err("Unable to allocate memory for struct iscsi_conn_ops.\n");
1157+
goto put_transport;
1158+
}
1159+
1160+
if (!zalloc_cpumask_var(&conn->conn_cpumask, GFP_KERNEL)) {
1161+
pr_err("Unable to allocate conn->conn_cpumask\n");
1162+
goto free_mask;
1163+
}
1164+
1165+
return conn;
1166+
1167+
free_mask:
1168+
free_cpumask_var(conn->conn_cpumask);
1169+
put_transport:
1170+
iscsit_put_transport(conn->conn_transport);
1171+
free_conn:
1172+
kfree(conn);
1173+
return NULL;
1174+
}
1175+
1176+
void iscsit_free_conn(struct iscsi_conn *conn)
1177+
{
1178+
free_cpumask_var(conn->conn_cpumask);
1179+
kfree(conn->conn_ops);
1180+
iscsit_put_transport(conn->conn_transport);
1181+
kfree(conn);
1182+
}
1183+
11521184
void iscsi_target_login_sess_out(struct iscsi_conn *conn,
11531185
struct iscsi_np *np, bool zero_tsih, bool new_sess)
11541186
{
@@ -1198,10 +1230,6 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn,
11981230
crypto_free_ahash(tfm);
11991231
}
12001232

1201-
free_cpumask_var(conn->conn_cpumask);
1202-
1203-
kfree(conn->conn_ops);
1204-
12051233
if (conn->param_list) {
12061234
iscsi_release_param_list(conn->param_list);
12071235
conn->param_list = NULL;
@@ -1219,8 +1247,7 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn,
12191247
if (conn->conn_transport->iscsit_free_conn)
12201248
conn->conn_transport->iscsit_free_conn(conn);
12211249

1222-
iscsit_put_transport(conn->conn_transport);
1223-
kfree(conn);
1250+
iscsit_free_conn(conn);
12241251
}
12251252

12261253
static int __iscsi_target_login_thread(struct iscsi_np *np)
@@ -1250,49 +1277,30 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
12501277
}
12511278
spin_unlock_bh(&np->np_thread_lock);
12521279

1253-
conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
1280+
conn = iscsit_alloc_conn(np);
12541281
if (!conn) {
1255-
pr_err("Could not allocate memory for"
1256-
" new connection\n");
12571282
/* Get another socket */
12581283
return 1;
12591284
}
1260-
pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
1261-
conn->conn_state = TARG_CONN_STATE_FREE;
1262-
1263-
timer_setup(&conn->nopin_response_timer,
1264-
iscsit_handle_nopin_response_timeout, 0);
1265-
timer_setup(&conn->nopin_timer, iscsit_handle_nopin_timeout, 0);
1266-
1267-
if (iscsit_conn_set_transport(conn, np->np_transport) < 0) {
1268-
kfree(conn);
1269-
return 1;
1270-
}
12711285

12721286
rc = np->np_transport->iscsit_accept_np(np, conn);
12731287
if (rc == -ENOSYS) {
12741288
complete(&np->np_restart_comp);
1275-
iscsit_put_transport(conn->conn_transport);
1276-
kfree(conn);
1277-
conn = NULL;
1289+
iscsit_free_conn(conn);
12781290
goto exit;
12791291
} else if (rc < 0) {
12801292
spin_lock_bh(&np->np_thread_lock);
12811293
if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
12821294
np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
12831295
spin_unlock_bh(&np->np_thread_lock);
12841296
complete(&np->np_restart_comp);
1285-
iscsit_put_transport(conn->conn_transport);
1286-
kfree(conn);
1287-
conn = NULL;
1297+
iscsit_free_conn(conn);
12881298
/* Get another socket */
12891299
return 1;
12901300
}
12911301
spin_unlock_bh(&np->np_thread_lock);
1292-
iscsit_put_transport(conn->conn_transport);
1293-
kfree(conn);
1294-
conn = NULL;
1295-
goto out;
1302+
iscsit_free_conn(conn);
1303+
return 1;
12961304
}
12971305
/*
12981306
* Perform the remaining iSCSI connection initialization items..
@@ -1442,7 +1450,6 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
14421450
tpg_np = NULL;
14431451
}
14441452

1445-
out:
14461453
return 1;
14471454

14481455
exit:

‎drivers/target/iscsi/iscsi_target_login.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ extern int iscsi_target_setup_login_socket(struct iscsi_np *,
1919
extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
2020
extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
2121
extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
22-
extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
22+
extern void iscsit_free_conn(struct iscsi_conn *);
2323
extern int iscsit_start_kthreads(struct iscsi_conn *);
2424
extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
2525
extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,

0 commit comments

Comments
 (0)