Patch "IB/srpt: Simplify srpt_handle_tsk_mgmt()" has been added to the 4.4-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
IB/srpt: Simplify srpt_handle_tsk_mgmt()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ib-srpt-simplify-srpt_handle_tsk_mgmt.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
51093254bf879bc9ce96590400a87897c7498463Mon Sep 17 00:00:00 2001
From: Bart Van Assche <[email protected]>
Date: Thu, 11 Feb 2016 11:03:09 -0800
Subject: IB/srpt: Simplify srpt_handle_tsk_mgmt()
From: Bart Van Assche <[email protected]>
commit 51093254bf879bc9ce96590400a87897c7498463 upstream.
Let the target core check task existence instead of the SRP target driver. Additionally, let the target core check the validity of the task management request instead of the ib_srpt driver.
This patch fixes the following kernel crash:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 IP: [<ffffffffa0565f37>] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt] Oops: 0002 [#1] SMP Call Trace: [<ffffffffa05660ce>] srpt_process_completion+0xde/0x570 [ib_srpt] [<ffffffffa056669f>] srpt_compl_thread+0x13f/0x160 [ib_srpt] [<ffffffff8109726f>] kthread+0xcf/0xe0 [<ffffffff81613cfc>] ret_from_fork+0x7c/0xb0
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 59 ---------------------------------- 1 file changed, 1 insertion(+), 58 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -58
@@ -1737,47 +1737,6 @@ send_sense:return -1 ; } -/** -* srpt_rx_mgmt_fn_tag() - Process a task management function by tag. -* @ch: RDMA channel of the task management request. -* @fn: Task management function to perform. -* @req_tag: Tag of the SRP task management request. -* @mgmt_ioctx: I/O context of the task management request. -* -* Returns zero if the target core will process the task management -* request asynchronously. -* -* Note: It is assumed that the initiator serializes tag-based task management -* requests. -*/ -static int srpt_rx_mgmt_fn_tag (struct srpt_send_ioctx *ioctx,u64 tag) -{ -struct srpt_device *sdev; -struct srpt_rdma_ch *ch; -struct srpt_send_ioctx *target; -int ret, i; - - ret = -EINVAL ; - ch = ioctx->ch; -BUG_ON (!ch); -BUG_ON (!ch->sport); - sdev = ch->sport->sdev; -BUG_ON (!sdev); -spin_lock_irq (&sdev->spinlock); -for (i =0 ; i < ch->rq_size; ++i) { - target = ch->ioctx_ring[i]; -if (target->cmd.se_lun == ioctx->cmd.se_lun && - target->cmd.tag == tag && -srpt_get_cmd_state (target) !=SRPT_STATE_DONE ) { - ret =0 ; -/* now let the target core abort &target->cmd; */ -break ; - } - } -spin_unlock_irq (&sdev->spinlock); -return ret; -} -static int srp_tmr_to_tcm (int fn) {switch (fn) {
@@ -1812,7 +1771,6 @@ static void srpt_handle_tsk_mgmt(structstruct se_cmd *cmd;struct se_session *sess = ch->sess;uint64_t unpacked_lun; -uint32_t tag =0 ;int tcm_tmr;int rc;
@@ -1828,25 +1786,10 @@ static void srpt_handle_tsk_mgmt(structsrpt_set_cmd_state (send_ioctx,SRPT_STATE_MGMT ); send_ioctx->cmd.tag = srp_tsk->tag; tcm_tmr =srp_tmr_to_tcm (srp_tsk->tsk_mgmt_func); -if (tcm_tmr <0 ) { - send_ioctx->cmd.se_tmr_req->response = -TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED ; - goto fail; - } unpacked_lun =srpt_unpack_lun ((uint8_t *)&srp_tsk->lun,sizeof (srp_tsk->lun)); - -if (srp_tsk->tsk_mgmt_func ==SRP_TSK_ABORT_TASK ) { - rc =srpt_rx_mgmt_fn_tag (send_ioctx, srp_tsk->task_tag); -if (rc <0 ) { - send_ioctx->cmd.se_tmr_req->response = -TMR_TASK_DOES_NOT_EXIST ; - goto fail; - } - tag = srp_tsk->task_tag; - } rc =target_submit_tmr (&send_ioctx->cmd, sess,NULL , unpacked_lun, - srp_tsk, tcm_tmr,GFP_KERNEL , tag, + srp_tsk, tcm_tmr,GFP_KERNEL , srp_tsk->task_tag,TARGET_SCF_ACK_KREF );if (rc !=0 ) { send_ioctx->cmd.se_tmr_req->response =TMR_FUNCTION_REJECTED ;
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/ib-srpt-simplify-srpt_handle_tsk_mgmt.patch queue-4.4/sd-fix-discard-granularity-when-lbprz-1.patch queue-4.4/brd-fix-discard-request-processing.patch