tcm_fc: Add abort flag for gracefully handling exchange timeout

Add abort flag and use it to terminate processing when an exchange
is timed out or is reset. The abort flag is used in place of the
transport_generic_free_cmd function call in the reset and timeout
cases, because calling that function in that context would free
memory that was in use. The aborted flag allows the lifetime to
be managed in a more normal way, while truncating the processing.

This change eliminates a source of memory corruption which
manifested in a variety of ugly ways.

(nab: Drop unused struct fc_exch *ep in ft_recv_seq)

Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
Acked-by: Kiran Patil <Kiran.patil@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index 830657908db82d56627aec24ccc7f8844091c19a..c5eb3c33c3dbed83db4b647c07619e44f320659f 100644 (file)
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -122,6 +122,7 @@ struct ft_cmd {
        /* Local sense buffer */
        unsigned char ft_sense_buffer[TRANSPORT_SENSE_BUFFER];
        u32 was_ddp_setup:1;            /* Set only if ddp is setup */
+       u32 aborted:1;                  /* Set if aborted by reset or timeout */
        struct scatterlist *sg;         /* Set only if DDP is setup */
        u32 sg_cnt;                     /* No. of item in scatterlist */
 };

diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 62dec9715ce57a37643e18d26caad8751349adab..a375f257aabcc80b19ca4d369ba4d54e5663881a 100644 (file)
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -121,6 +121,8 @@ int ft_queue_status(struct se_cmd *se_cmd)
        struct fc_exch *ep;
        size_t len;
 
+       if (cmd->aborted)
+               return 0;
        ft_dump_cmd(cmd, __func__);
        ep = fc_seq_exch(cmd->seq);
        lport = ep->lp;
@@ -187,6 +189,8 @@ int ft_write_pending(struct se_cmd *se_cmd)
 
        ft_dump_cmd(cmd, __func__);
 
+       if (cmd->aborted)
+               return 0;
        ep = fc_seq_exch(cmd->seq);
        lport = ep->lp;
        fp = fc_frame_alloc(lport, sizeof(*txrdy));
@@ -252,10 +256,10 @@ static void ft_recv_seq(struct fc_seq *sp, struct fc_frame *fp, void *arg)
        struct ft_cmd *cmd = arg;
        struct fc_frame_header *fh;
 
-       if (IS_ERR(fp)) {
+       if (unlikely(IS_ERR(fp))) {
                /* XXX need to find cmd if queued */
                cmd->seq = NULL;
-               transport_generic_free_cmd(&cmd->se_cmd, 0);
+               cmd->aborted = true;
                return;
        }
 
@@ -399,6 +403,8 @@ int ft_queue_tm_resp(struct se_cmd *se_cmd)
        struct se_tmr_req *tmr = se_cmd->se_tmr_req;
        enum fcp_resp_rsp_codes code;
 
+       if (cmd->aborted)
+               return 0;
        switch (tmr->response) {
        case TMR_FUNCTION_COMPLETE:
                code = FCP_TMF_CMPL;

diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
index 2b693eefac556064c6dd54747fa7516cdb008469..dc7c0db26e20f2aa8e1be2e0ec7b471cce59b0ab 100644 (file)
--- a/drivers/target/tcm_fc/tfc_io.c
+++ b/drivers/target/tcm_fc/tfc_io.c
@@ -81,6 +81,8 @@ int ft_queue_data_in(struct se_cmd *se_cmd)
        void *from;
        void *to = NULL;
 
+       if (cmd->aborted)
+               return 0;
        ep = fc_seq_exch(cmd->seq);
        lport = ep->lp;
        cmd->seq = lport->tt.seq_start_next(cmd->seq);