linux-sg2042/drivers/target
Nicholas Bellinger 72859d91d9 iscsi-target: Avoid IN_LOGOUT failure case for iser-target
This patch addresses a bug reported during iser-target login/logout
stress testing, where iscsit_take_action_for_connection_exit() is
incorrectly invoking iscsit_close_connection() twice during IN_LOGOUT
state, after connection shutdown has already been initiated by
iser-target code.

Here is the backtrace:

BUG: unable to handle kernel NULL pointer dereference at 00000000000001f0
IP: [<ffffffffa033d992>] iscsit_take_action_for_connection_exit+0x62/0x110 [iscsi_target_mod]
PGD 0
Oops: 0000 [#1] SMP
Modules linked in: target_core_pscsi(O) target_core_file(O) target_core_iblock(O) ib_isert(O) iscsi_target_mod(O) ib_srpt(O) tcm_loop(O) tcm_fc(O) target_core_mod(O) mst_pciconf(OE) bonding mlx5_ib(O) mlx5_core libfc scsi_transport_fc netconsole configfs nfsv3 nfs_acl mlx4_ib(O) rdma_ucm(O) ib_ucm(O) rdma_cm(O) iw_cm(O) ib_uverbs(O) libiscsi_tcp libiscsi scsi_transport_iscsi mlx4_en mlx4_core ib_ipoib(O) ib_cm(O) ib_sa(O) ib_umad(O) ib_mad(O) ib_core(O) ib_addr(O) rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs fscache lockd grace autofs4 sunrpc 8021q garp stp llc ipv6 dm_mirror dm_region_hash dm_log dm_multipath uinput ipmi_si ipmi_msghandler acpi_pad iTCO_wdt iTCO_vendor_support dcdbas microcode pcspkr wmi sb_edac edac_core sg lpc_ich mfd_core shpchp tg3 ptp pps_core dm_mod ext3(E) jbd(E) mbcache(E) sr_mod(E) cdrom(E) sd_mod(E) ahci(E) libahci(E) megaraid_sas(E) [last unloaded: target_core_mod]
CPU: 2 PID: 5280 Comm: iscsi_ttx Tainted: G        W  OE  3.18.0-rc2+ #22
Hardware name: Dell Inc. PowerEdge R720/0VWT90, BIOS 2.0.9 03/08/2013
task: ffff8806132f9010 ti: ffff880601d6c000 task.ti: ffff880601d6c000
RIP: 0010:[<ffffffffa033d992>] [<ffffffffa033d992>] iscsit_take_action_for_connection_exit+0x62/0x110 [iscsi_target_mod]
RSP: 0018:ffff880601d6fe18  EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffff8805dc437800 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000200 RDI: ffffffffa033d98b
RBP: ffff880601d6fe28 R08: 0000000000000000 R09: 000000000000dd37
R10: 00000000ec5d4202 R11: 0000000000000001 R12: ffff8805dc437bf4
R13: ffff88061b831600 R14: ffff880601d6fe58 R15: ffff8806132f9010
FS:  0000000000000000(0000) GS:ffff88032fa20000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000001f0 CR3: 0000000001a14000 CR4: 00000000000407e0
Stack:
ffff8805dc437800 fffffffffffffe00 ffff880601d6feb8 ffffffffa034ed40
ffff8806132f9010 ffff880601d6fe70 0f00000000000000 ffff8805d51fbef0
0000000000000000 ffff8806132f9010 ffffffff8108e7f0 ffff880601d6fe70
Call Trace:
[<ffffffffa034ed40>] iscsi_target_tx_thread+0x160/0x220 [iscsi_target_mod]
[<ffffffff8108e7f0>] ? bit_waitqueue+0xb0/0xb0
[<ffffffffa034ebe0>] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod]
[<ffffffff8107017e>] kthread+0xce/0xf0
[<ffffffff810700b0>] ? kthread_freezable_should_stop+0x70/0x70
[<ffffffff815a0b6c>] ret_from_fork+0x7c/0xb0
[<ffffffff810700b0>] ? kthread_freezable_should_stop+0x70/0x70
Code: 06 0f 84 82 00 00 00 3c 08 74 4e f6 05 39 e6 02 00 04 0f 85 9e 00 00 00 c6 43 19 08 4c 89 e7 e8 65 2a 26 e1 48 8b 83 a0 04 00 00 <48> 8b 88 f0 01 00 00 80 b9 d8 04 00 00 02 74 2e f6 05 31 e6 02
RIP  [<ffffffffa033d992>] iscsit_take_action_for_connection_exit+0x62/0x110 [iscsi_target_mod]
RSP <ffff880601d6fe18>
CR2: 00000000000001f0
---[ end trace a0c33436cd0836b4 ]---

This special case is still required by ISCSI_TCP transport during a
iscsit_handle_logout_cmd() failure case in iscsi_target_rx_opcode(),
but must be avoided for iser-target.

Reported-by: Sagi Grimberg <sagig@mellanox.com>
Reported-by: Slava Shwartsman <valyushash@gmail.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Slava Shwartsman <valyushash@gmail.com>
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2015-02-12 12:24:12 -08:00
..
iscsi iscsi-target: Avoid IN_LOGOUT failure case for iser-target 2015-02-12 12:24:12 -08:00
loopback SCSI for-linus on 20141220 2014-12-20 13:42:57 -08:00
sbp scsi: remove MSG_*_TAG defines 2014-12-04 09:58:33 +01:00
tcm_fc scsi: remove MSG_*_TAG defines 2014-12-04 09:58:33 +01:00
Kconfig target: Add a user-passthrough backstore 2014-10-03 11:15:20 -07:00
Makefile target: Add a user-passthrough backstore 2014-10-03 11:15:20 -07:00
target_core_alua.c scsi: rename SERVICE_ACTION_IN to SERVICE_ACTION_IN_16 2014-11-24 20:01:40 +01:00
target_core_alua.h target_core_alua: Referrals configfs integration 2014-01-09 21:48:35 -08:00
target_core_configfs.c target: Drop left-over internal dev attribute code 2014-12-01 21:36:21 -08:00
target_core_device.c target: Drop left-over PHBA_PDEV set attr checks 2014-12-01 21:36:21 -08:00
target_core_fabric_configfs.c target: Change core_dev_del_lun to take a se_lun instead of unpacked_lun 2014-10-01 14:38:48 -07:00
target_core_fabric_lib.c target: fix pr_out length in iscsi_parse_pr_out_transport_id 2014-09-17 15:17:35 -07:00
target_core_file.c target/file: Convert to external fileio_backend_dev_attrs 2014-12-01 21:36:02 -08:00
target_core_file.h Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2014-01-31 15:31:23 -08:00
target_core_hba.c target: Move dev_cit to struct se_subsystem_api 2014-12-01 21:35:22 -08:00
target_core_iblock.c target/iblock: Convert to external iblock_backend_dev_attrs 2014-12-01 21:36:02 -08:00
target_core_iblock.h target: kill struct se_subsystem_dev 2012-11-06 20:55:43 -08:00
target_core_internal.h target: Add EXPORT_SYMBOL for existing se_dev_set_* 2014-12-01 21:36:02 -08:00
target_core_pr.c target: Fix PR_APTPL_BUF_LEN buffer size limitation 2015-02-12 12:24:12 -08:00
target_core_pr.h target: Fix APTPL metadata handling for dynamic MappedLUNs 2014-10-04 05:40:19 +00:00
target_core_pscsi.c SCSI for-linus on 20141220 2014-12-20 13:42:57 -08:00
target_core_pscsi.h target: kill struct se_subsystem_dev 2012-11-06 20:55:43 -08:00
target_core_rd.c target/rd: Convert to external rd_mcp_backend_dev_attrs 2014-12-01 21:36:02 -08:00
target_core_rd.h target/rd: Add support for protection SGL setup + release 2014-01-19 02:22:05 +00:00
target_core_sbc.c Merge remote-tracking branch 'scsi-queue/drivers-for-3.19' into for-linus 2014-12-18 05:56:29 -08:00
target_core_spc.c scsi: remove MSG_*_TAG defines 2014-12-04 09:58:33 +01:00
target_core_stat.c target: Convert se_device statistics to atomic_long_t 2013-11-13 18:34:55 -08:00
target_core_tmr.c target: simplify core_tmr_abort_task 2014-10-01 14:39:10 -07:00
target_core_tpg.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2014-10-21 13:06:38 -07:00
target_core_transport.c Merge remote-tracking branch 'scsi-queue/drivers-for-3.19' into for-linus 2014-12-18 05:56:29 -08:00
target_core_ua.c target: encapsulate smp_mb__after_atomic() 2014-10-01 14:39:06 -07:00
target_core_ua.h target: target_core_ua_h: Add #define of include guard 2014-09-15 14:27:43 -07:00
target_core_user.c target/user: Convert to external tcmu_backend_dev_attrs 2014-12-01 21:36:03 -08:00
target_core_xcopy.c treewide: fix typo in printk and Kconfig 2014-11-20 14:56:11 +01:00
target_core_xcopy.h target: Add support for EXTENDED_COPY copy offload emulation 2013-09-10 16:48:43 -07:00