Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

iscsi-target: Fix mutex_trylock usage in iscsit_increment_maxcmdsn

This patch fixes a >= v3.10 regression bug with mutex_trylock() usage
within iscsit_increment_maxcmdsn(), that was originally added to allow
for a special case where ->cmdsn_mutex was already held from the
iscsit_execute_cmd() exception path for ib_isert.

When !mutex_trylock() was occuring under contention during normal RX/TX
process context codepaths, the bug was manifesting itself as the following
protocol error:

Received CmdSN: 0x000fcbb7 is greater than MaxCmdSN: 0x000fcbb6, protocol error.
Received CmdSN: 0x000fcbb8 is greater than MaxCmdSN: 0x000fcbb6, protocol error.

This patch simply avoids the direct ib_isert callback in lio_queue_status()
for the special iscsi_execute_cmd() exception cases, that allows the problematic
mutex_trylock() usage in iscsit_increment_maxcmdsn() to go away.

Reported-by: Moussa Ba <moussaba@micron.com>
Tested-by: Moussa Ba <moussaba@micron.com>
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

+6 -5
+5
drivers/target/iscsi/iscsi_target_configfs.c
··· 1790 1790 struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd); 1791 1791 1792 1792 cmd->i_state = ISTATE_SEND_STATUS; 1793 + 1794 + if (cmd->se_cmd.scsi_status || cmd->sense_reason) { 1795 + iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state); 1796 + return 0; 1797 + } 1793 1798 cmd->conn->conn_transport->iscsit_queue_status(cmd->conn, cmd); 1794 1799 1795 1800 return 0;
+1 -5
drivers/target/iscsi/iscsi_target_device.c
··· 58 58 59 59 cmd->maxcmdsn_inc = 1; 60 60 61 - if (!mutex_trylock(&sess->cmdsn_mutex)) { 62 - sess->max_cmd_sn += 1; 63 - pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn); 64 - return; 65 - } 61 + mutex_lock(&sess->cmdsn_mutex); 66 62 sess->max_cmd_sn += 1; 67 63 pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn); 68 64 mutex_unlock(&sess->cmdsn_mutex);