Patch "target: Fix PR registration + APTPL RCU conversion regression" has been added to the 4.2-stable tree

This is a note to let you know that I've just added the patch titled

target: Fix PR registration + APTPL RCU conversion regression

to the 4.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
target-fix-pr-registration-aptpl-rcu-conversion-regression.patch
and it can be found in the queue-4.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Nicholas Bellinger <[email protected]>
Date: Sun, 13 Sep 2015 02:30:46 -0700
Subject: target: Fix PR registration + APTPL RCU conversion regression

From: Nicholas Bellinger <[email protected]>

commit 3ccd6e83df8a0d4a664edeecc453c4fa046395fb upstream.

This patch fixes a v4.2+ regression introduced by commit 79dc9c9e86 where lookup of t10_pr_registration->pr_reg_deve and associated ->pr_kref get was missing from __core_scsi3_do_alloc_registration(), which is responsible for setting DEF_PR_REG_ACTIVE.

This would result in REGISTER operations completing successfully, but subsequent core_scsi3_pr_seq_non_holder() checking would fail with !DEF_PR_REG_ACTIVE -> RESERVATION CONFLICT status.

Update __core_scsi3_add_registration() to drop ->pr_kref reference after registration and any optional ALL_TG_PT=1 processing has completed. Update core_scsi3_decode_spec_i_port() to release the new parent local_pr_reg->pr_kref as well.

Also, update __core_scsi3_check_aptpl_registration() to perform the same target_nacl_find_deve() lookup + ->pr_kref get, now that __core_scsi3_add_registration() expects to drop the reference.

Finally, since there are cases when se_dev_entry->se_lun_acl can still be dereferenced in core_scsi3_lunacl_undepend_item() while holding ->pr_kref, go ahead and move explicit rcu_assign_pointer() NULL assignments within core_disable_device_list_for_node() until after orig->pr_comp finishes.

---
 drivers/target/target_core_device.c |    5 +
 drivers/target/target_core_pr.c     |   91 ++++++++++++++++++++++++++----------
 2 files changed, 70 insertions(+), 26 deletions(-)

@@ -427,8 +427,6 @@ void core_disable_device_list_for_node(
 
 	hlist_del_rcu(&orig->link);
 	clear_bit(DEF_PR_REG_ACTIVE, &orig->deve_flags);
-	rcu_assign_pointer(orig->se_lun, NULL);
-	rcu_assign_pointer(orig->se_lun_acl, NULL);
 	orig->lun_flags = 0;
 	orig->creation_time = 0;
 	orig->attach_count--;

@@ -439,6 +437,9 @@ void core_disable_device_list_for_node(
 	kref_put(&orig->pr_kref, target_pr_kref_release);
 	wait_for_completion(&orig->pr_comp);
 
+	rcu_assign_pointer(orig->se_lun, NULL);
+	rcu_assign_pointer(orig->se_lun_acl, NULL);
+
 	kfree_rcu(orig, rcu_head);
 
 	core_scsi3_free_pr_reg_from_nacl(dev, nacl);

Patches currently in stable-queue which might be from [email protected] are

queue-4.2/target-iscsi-fix-np_ip-bracket-issue-by-removing-np_ip.patch queue-4.2/iser-target-put-the-reference-on-commands-waiting-for-unsol-data.patch queue-4.2/iser-target-remove-command-with-state-istate_remove.patch queue-4.2/target-attach-extended_copy-local-i-o-descriptors-to-xcopy_pt_sess.patch queue-4.2/target-fix-pr-registration-aptpl-rcu-conversion-regression.patch