6571905 iscsi target does not correctly keep track of maxcmdsn

6669625 iscsitgtd core dumps: Reserve followed by logout
6693639 Assertion failed: 0, file ../t10_sam.c, line 640

3 files changed, 14 insertions, 12 deletions

diff --git a/usr/src/cmd/iscsi/iscsitgtd/iscsi_cmd.c b/usr/src/cmd/iscsi/iscsitgtd/iscsi_cmd.c
index 7c82f3c0ef..2683e1f9ef 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/iscsi_cmd.c
+++ b/usr/src/cmd/iscsi/iscsitgtd/iscsi_cmd.c
@@ -143,6 +143,8 @@ iscsi_cmd_free(iscsi_conn_t *c, iscsi_cmd_t *cmd)
 	cmd->c_t_completion	= h - cmd->c_t_start;
 	c->c_cmds_avg_sum	+= cmd->c_t_completion;
 	c->c_cmds_avg_cnt++;
+	/* decrement active count here */
+	c->c_cmds_active--;
 }
 
 /*
@@ -226,7 +228,6 @@ iscsi_cmd_remove(iscsi_conn_t *c, uint32_t statsn)
 				cmd->c_next = cmd_free;
 				cmd_free = cmd;
 				cmd = n;
-				c->c_cmds_active--;
 			} else {
 				cmd = cmd->c_next;
 			}
diff --git a/usr/src/cmd/iscsi/iscsitgtd/iscsi_login.c b/usr/src/cmd/iscsi/iscsitgtd/iscsi_login.c
index 6146d62318..ddff81453c 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/iscsi_login.c
+++ b/usr/src/cmd/iscsi/iscsitgtd/iscsi_login.c
@@ -740,8 +740,9 @@ make_login_response(iscsi_conn_t *c, iscsi_login_hdr_t *lhp)
 	if (c->c_sess != NULL) {
 		(void) pthread_mutex_lock(&c->c_sess->s_mutex);
 		/* ---- cmdsn is not advanced during login ---- */
-		r->expcmdsn		= htonl(c->c_sess->s_seencmdsn);
-		r->maxcmdsn		= htonl(c->c_sess->s_seencmdsn + 1);
+		r->expcmdsn	= htonl(c->c_sess->s_seencmdsn);
+		r->maxcmdsn	= htonl(CMD_MAXOUTSTANDING +
+		    c->c_sess->s_seencmdsn);
 		(void) pthread_mutex_unlock(&c->c_sess->s_mutex);
 	}
 
diff --git a/usr/src/cmd/iscsi/iscsitgtd/t10_sam.c b/usr/src/cmd/iscsi/iscsitgtd/t10_sam.c
index 1f510b2091..7ca21411de 100644
--- a/usr/src/cmd/iscsi/iscsitgtd/t10_sam.c
+++ b/usr/src/cmd/iscsi/iscsitgtd/t10_sam.c
@@ -485,11 +485,11 @@ t10_cmd_done(t10_cmd_t *cmd)
  *	---+---------+---+---+---+---+-------+
  *	 S2|T5       | - |T2 |T3 |T7 |T6 | - |
  *	---+---------+---+---+---+---+-------+
- *	 S3|T5/6     |T4 | - | - |T7 | - | - |
+ *	 S3|T5       |T4 | - | - |T7 |T6 | - |
  *	---+---------+---+---+---+---+-------+
  *	 S4|T5       |T4 | - | - | - | - |T6 |
  *	---+---------+---+---+---+---+-------+
- *	 S5|T6       | - |T4 | - | - | - | - |
+ *	 S5|         | - |T4 | - | - |T6 | - |
  *	---+---------+---+---+---+---+-------+
  *       S6|T2/4/5/6 | - | - | - | - | - |T3 |
  *	---+---------+---+---+---+---+-------+
@@ -585,12 +585,14 @@ t10_cmd_state_machine(t10_cmd_t *c, t10_cmd_event_t e)
 			break;
 
 		case T10_Cmd_T5:
-			/*FALLTHRU*/
-		case T10_Cmd_T6:
 			c->c_state = T10_Cmd_S1_Free;
 			cmd_common_free(c);
 			return (T10_Cmd_S1_Free);
 
+		case T10_Cmd_T6:
+			c->c_state = T10_Cmd_S6_Freeing_In;
+			break;
+
 		case T10_Cmd_T7:
 			c->c_state = T10_Cmd_S5_Wait;
 			break;
@@ -633,9 +635,8 @@ t10_cmd_state_machine(t10_cmd_t *c, t10_cmd_event_t e)
 			break;
 
 		case T10_Cmd_T6:
-			c->c_state = T10_Cmd_S1_Free;
-			cmd_common_free(c);
-			return (T10_Cmd_S1_Free);
+			c->c_state = T10_Cmd_S6_Freeing_In;
+			break;
 
 		default:
 			queue_prt(mgmtq, Q_STE_ERRS,
@@ -1832,11 +1833,10 @@ lu_runner(void *v)
 			(void) pthread_mutex_lock(&lu->l_common_mutex);
 			assert(avl_find(&lu->l_all_open, (void *)itl, NULL) !=
 			    NULL);
-			avl_remove(&lu->l_all_open, (void *)itl);
-
 			queue_walker_free(lu->l_from_transports,
 			    lu_remove_cmds, (void *)itl);
 			(*sam_emul_table[lu->l_dtype].t_per_fini)(itl);
+			avl_remove(&lu->l_all_open, (void *)itl);
 
 			/*
 			 * Don't remove reference to l_common area until after