6622067 Target daemon coredumps after attempting to delete all luns

6674573 Error path defect causes iSCSI Target core
6676326 iscsitgtd SIGABRT failed assert cmd->c_state != CmdFree, file ../iscsi_cmd.c, line 141
6677518 iSCSI target coredumped while running racer on 7 QFS initiators
6683421 Target daemon coredump running fslt on stripe group

6 files changed, 45 insertions, 14 deletions

diff --git a/usr/src/cmd/iscsi/iscsitgtd/iscsi_conn.c b/usr/src/cmd/iscsi/iscsitgtd/iscsi_conn.c
index e0d6259d0f..74f743b0f6 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/iscsi_conn.c
+++ b/usr/src/cmd/iscsi/iscsitgtd/iscsi_conn.c
@@ -387,6 +387,7 @@ conn_process(void *v)
 	 * who have alligence to this connection and free them as well.
 	 */
 	(void) pthread_mutex_lock(&c->c_mutex);
+	(void) pthread_mutex_lock(&c->c_state_mutex);
 
 	for (i = 0, cmd = c->c_cmd_head; cmd; i++)
 		cmd = cmd->c_next; /* debug count of lost ttt's */
@@ -425,6 +426,7 @@ conn_process(void *v)
 		umem_cache_free(iscsi_cmd_cache, cmd);
 		cmd = n;
 	}
+	(void) pthread_mutex_unlock(&c->c_state_mutex);
 	(void) pthread_mutex_unlock(&c->c_mutex);
 
 	if (i) {
diff --git a/usr/src/cmd/iscsi/iscsitgtd/iscsi_login.c b/usr/src/cmd/iscsi/iscsitgtd/iscsi_login.c
index a0a9bdb5de..a7f27c585b 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/iscsi_login.c
+++ b/usr/src/cmd/iscsi/iscsitgtd/iscsi_login.c
@@ -737,12 +737,13 @@ make_login_response(iscsi_conn_t *c, iscsi_login_hdr_t *lhp)
 	(void) pthread_mutex_lock(&c->c_mutex);
 	r->statsn		= htonl(c->c_statsn++);
 	(void) pthread_mutex_unlock(&c->c_mutex);
-	(void) pthread_mutex_lock(&c->c_sess->s_mutex);
-	/* ---- cmdsn is not advanced during login ---- */
-	r->expcmdsn		= htonl(c->c_sess->s_seencmdsn);
-	r->maxcmdsn		= htonl(c->c_sess->s_seencmdsn + 1);
-	(void) pthread_mutex_unlock(&c->c_sess->s_mutex);
-
+	if (c->c_sess != NULL) {
+		(void) pthread_mutex_lock(&c->c_sess->s_mutex);
+		/* ---- cmdsn is not advanced during login ---- */
+		r->expcmdsn		= htonl(c->c_sess->s_seencmdsn);
+		r->maxcmdsn		= htonl(c->c_sess->s_seencmdsn + 1);
+		(void) pthread_mutex_unlock(&c->c_sess->s_mutex);
+	}
 
 	return (r);
 }
diff --git a/usr/src/cmd/iscsi/iscsitgtd/mgmt_list.c b/usr/src/cmd/iscsi/iscsitgtd/mgmt_list.c
index ff6d416472..0d42467135 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/mgmt_list.c
+++ b/usr/src/cmd/iscsi/iscsitgtd/mgmt_list.c
@@ -408,6 +408,8 @@ target_info(char **msg, char *targ_name, tgt_node_t *tnode)
 			if (local_name != NULL) {
 				mgmt_get_param(&params, local_name, lun_num);
 				free(local_name);
+			} else {
+				continue;
 			}
 		} else {
 			params = lun;
diff --git a/usr/src/cmd/iscsi/iscsitgtd/t10.h b/usr/src/cmd/iscsi/iscsitgtd/t10.h
index aacd8ea2d0..ac32fb1146 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/t10.h
+++ b/usr/src/cmd/iscsi/iscsitgtd/t10.h
@@ -563,6 +563,9 @@ Boolean_t
 t10_cmd_data(t10_targ_handle_t t, t10_cmd_t *cmd, size_t offset,
     char *data, size_t data_len);
 
+void
+t10_cmd_done(t10_cmd_t *cmd);
+
 Boolean_t
 t10_task_mgmt(t10_targ_handle_t t, TaskOp_t op, int opt_lun, void *tag);
 
diff --git a/usr/src/cmd/iscsi/iscsitgtd/t10_sam.c b/usr/src/cmd/iscsi/iscsitgtd/t10_sam.c
index 6d2ac5987f..c8db08abd1 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/t10_sam.c
+++ b/usr/src/cmd/iscsi/iscsitgtd/t10_sam.c
@@ -452,6 +452,13 @@ t10_cmd_data(t10_targ_handle_t t, t10_cmd_t *cmd, size_t offset, char *data,
 	return (True);
 }
 
+void
+t10_cmd_done(t10_cmd_t *cmd)
+{
+	if (cmd != NULL)
+		t10_cmd_shoot_event(cmd, T10_Cmd_T5);
+}
+
 /*
  * t10_cmd_state_machine -- State machine for T10 commands
  *
@@ -1071,11 +1078,11 @@ trans_cmd_dup(t10_cmd_t *cmd)
 	t10_cmd_t	*c;
 
 	if ((c = umem_cache_alloc(t10_cmd_cache, UMEM_DEFAULT)) == NULL)
-		return (False);
+		return (NULL);
 	bcopy(cmd, c, sizeof (*c));
 	if ((c->c_cdb = (uint8_t *)malloc(c->c_cdb_len)) == NULL) {
 		umem_cache_free(t10_cmd_cache, c);
-		return (False);
+		return (NULL);
 	}
 	bcopy(cmd->c_cdb, c->c_cdb, c->c_cdb_len);
 
@@ -1467,6 +1474,8 @@ t10_find_lun(t10_targ_impl_t *t, int lun, t10_cmd_t *cmd)
 		goto error;
 	}
 
+	(void) pthread_mutex_lock(&lu_list_mutex);
+
 	if (tgt_find_value_str(n, XML_ELEMENT_GUID, &guid) == False) {
 		/*
 		 * Set the targ variable back to NULL to indicate that we don't
@@ -2309,6 +2318,9 @@ cmd_common_free(t10_cmd_t *c)
 
 	if (lu) {
 		assert(pthread_mutex_trylock(&lu->l_cmd_mutex) != 0);
+		/* command might be removed by t10_handle_destroy */
+		if (avl_find(&lu->l_cmds, c, NULL) == NULL)
+			return;
 		avl_remove(&lu->l_cmds, c);
 	}
 
diff --git a/usr/src/cmd/iscsi/iscsitgtd/t10_sbc.c b/usr/src/cmd/iscsi/iscsitgtd/t10_sbc.c
index 43eb5741f1..e885b64f4a 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/t10_sbc.c
+++ b/usr/src/cmd/iscsi/iscsitgtd/t10_sbc.c
@@ -441,10 +441,16 @@ sbc_read(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
 
 	do {
 		min = MIN((cnt * 512) - offset, T10_MAX_OUT(cmd));
-		if ((offset + min) < (cnt * 512LL))
+		if ((offset + min) < (cnt * 512LL)) {
 			c = trans_cmd_dup(cmd);
-		else
+			/* dup failed, just finish the original command */
+			if (c == NULL) {
+				c = cmd;
+				offset = (cnt * 512);
+			}
+		} else {
 			c = cmd;
+		}
 		io = sbc_io_alloc(c);
 
 		io->da_lba	= addr;
@@ -498,6 +504,9 @@ sbc_read_cmplt(emul_handle_t id)
 	t10_cmd_t	*cmd		= io->da_cmd;
 	Boolean_t	last;
 
+	last = (io->da_offset + io->da_data_len) < (io->da_lba_cnt * 512LL) ?
+	    False : True;
+
 	if (io->da_aio.a_aio.aio_return != io->da_data_len) {
 		err_blkno = io->da_lba + ((io->da_offset + 511) / 512);
 		cmd->c_resid = (io->da_lba_cnt * 512) - io->da_offset;
@@ -507,13 +516,15 @@ sbc_read_cmplt(emul_handle_t id)
 			sense_len = 0;
 		spc_sense_create(cmd, KEY_HARDWARE_ERROR, sense_len);
 		spc_sense_info(cmd, err_blkno);
-		trans_send_complete(cmd, STATUS_CHECK);
-		sbc_io_free(io);
+		if (last == True) {
+			trans_send_complete(cmd, STATUS_CHECK);
+			sbc_io_free(io);
+		} else {
+			t10_cmd_done(cmd);
+		}
 		return;
 	}
 
-	last = (io->da_offset + io->da_data_len) < (io->da_lba_cnt * 512LL) ?
-	    False : True;
 	if (trans_send_datain(cmd, io->da_data, io->da_data_len, io->da_offset,
 	    sbc_io_free, last, io) == False) {
 		trans_send_complete(cmd, STATUS_BUSY);