Manual review found that isert_poll_cq forms &cq->wc[err] when
ib_poll_cq returns a negative errno. This pointer formation already
indexes outside the completion array, even if the following loop does
not dereference it. No saved analyzer diagnostic directly reports it.
Stop on nonpositive results before forming the end pointer and preserve
the result for the caller. Keep the loop exit next to the poll result.
Add the scst-ISER-cq KUnit suite to isert-scst.ko. Call the production
polling function with a private ib_device poll callback and task-local
stubs for the success and error completion handlers. Cover initial
-EIO and -EINVAL results, an empty queue, full and short batches, and
an error after completions. Check poll termination, completion order
and dispatch to the correct handler. Negative-result cases also exercise
kernel UBSAN bounds checking when CONFIG_UBSAN_BOUNDS is enabled.
Include iSER in the existing KUnit module inventory and build it after
iscsi-scst with the RDMA compatibility probes. Propagate the common
KUnit flags through ordinary iSER builds as well, so analyzer builds
include the suite. Extend tooling checks for module selection, dependency
order, cleanup, private headers and in-tree source export.
When every valid fallback tag is occupied, find_first_zero_bit returns
tag_num. The old loop calls test_and_set_bit before checking that
sentinel. If the bit was clear, it even exits the loop without checking
the range and uses tag_num as an index into tgt_cmd_map.
For word-aligned pool sizes this touches a word beyond the bitmap. For
other sizes it can claim padding in the last word. Both cases can return
an out-of-range command-map entry and let memset overwrite memory beyond
the map. Manual review found this bounds bug while auditing the fallback
allocation flagged by Coccinelle null/kmerr.cocci. No separate analyzer
diagnostic reported the invalid bitmap or command-map access.
Check the sentinel before test_and_set_bit and return -ENOENT when no tag
is available. Preserve the retry when another allocator wins the bit.
Expose the helper to the QLA KUnit suite in qla2x00tgt.ko.
Add KUnit cases for exhausted pools at word and non-word boundaries, an
empty pool, unchanged guard words and reuse of the final valid tag. A
spare guard word makes the old invalid access observable without needing
an actual out-of-bounds access in the test fixture.
Manual review of the allocation path flagged by Coccinelle's
null/kmerr.cocci rule found two resource leaks. No separate analyzer
diagnostic is recorded for these leaks. Failed SCST target registration
frees only sqa_tgt, and normal target release also leaves its command
map and tag pool behind. Repeated registration failures or target
recreation retain those allocations indefinitely.
Move allocation and cleanup into SCST-owned resource helpers. Unwind the
command map if tag initialization fails, and destroy both resources if
registration fails or the target is released. Preserve the bitmap,
percpu_ida and sbitmap backends selected by the existing kernel guards.
Target stop phase 1 uses bounded session waits. Before dropping lport
callbacks and releasing command storage, wait for the SCST session list
to drain. SCST removes each session after its commands and unregistration
callback have completed, so late command releases can still return tags.
Keep the helpers in scst_qla2xxx.c and link the QLA KUnit suite into
qla2x00tgt.ko, following the existing SCST module layout. Expose private
helpers only in test builds and use task-scoped registration and
allocation stubs. Cover map allocation failure, tag initialization
failure, registration failure and normal resource destruction.
Build and record the matching qla2xxx_scst.ko dependency for the runner,
and clean both module builds together. Extend the build and cleanup
fixtures to check this dependency and failure propagation.
The dependency has no tests of its own. Requiring every supplied module
to have a KUnit manifest made the runner abort before loading any module:
Module has no KUnit label manifest; rebuild with kunit-build
Accept modules without suites only when they are dependencies of supplied
test owners. Keep rejecting missing or malformed test manifests and
unrelated modules. Exercise native metadata parsing, label selection,
dependency load order and reverse cleanup in isolated runner fixtures.
The fixtures need no real target, but loading their owner still
initializes the QLogic drivers. Run them in a disposable VM without an
HBA; hardware session teardown requires separate integration validation.
Remove the issue #367 walkthrough from the KUnit guide and the smoke and
SCSI case lists from the Ginkgo guide. Keep scenario expectations with
the tests instead of duplicating them in runner documentation.
Retain label selection, environment requirements and artifact guidance.
Describe optional kernel-log collection without tying it to an issue.
Task-management initialization reads sess->acg before acquiring activity
protection. A concurrent reassignment can clear this pointer and later
drop the old ACG reference, so the read can dereference NULL or freed
storage even while ordinary command processing is suspended.
Keep a session-owned copy of the black-hole mode and read it with
READ_ONCE() in the TM path. Initialize it before admitting session work,
retain the old mode while replacing LUNs, and publish the new mode when
installing the new ACG. Update existing sessions on sysfs writes as well.
All writers hold scst_mutex and use WRITE_ONCE(); the TM command already
owns a session reference, so no additional locking or ACG reference is
needed for this scalar policy read.
Read the previous sysfs value under the same mutex so concurrent stores
cannot mistake a real change for a no-op and leave session copies stale.
Extend the private TM tests with sysfs mode transitions, rejected writes,
and old/new drop-policy checks inside and after real reassignment.
Remove the dedicated Ginkgo opt-in and Skip path now that the fix is
in place, so both teardown scenarios run whenever their labels are
selected, including full CI runs.
Link: https://github.com/SCST-project/scst/issues/367
Add opt-in issue-367 scenarios that move a fixture initiator between
disjoint LUN maps alongside logout or an exact TCP socket reset. Wait
for a fresh kernel reassignment message naming the initiator and groups
before requesting teardown, and require overlapping command intervals.
Verify group ownership, recovery and session cleanup after each move.
Capture new kernel records, reject diagnostics or incomplete evidence,
and preserve the target when teardown cannot be justified. Require an
explicit profile option even when all Ginkgo labels are selected.
Test socket selection, log observation and opt-in configuration.
The scenarios use nullio and do not implement a production fix or a
duplicate-IQN login generator. Kernel-observed reassignment and command
overlap do not prove that TM entered the NULL-ACG window; a successful
run means not reproduced.
Link: https://github.com/SCST-project/scst/issues/367
Issue #367 reports a TM thread dereferencing sess->acg while the session
reassignment path temporarily clears it. Add private fixtures covering
all black_hole modes for teardown TM functions, mode changes after real
reassignment, and the unchanged-group path.
Invoke the TM reader from the allocation stub during reassignment and
check command state, drop policy and event delivery for all five modes.
Keep the old and new modes equal in this case so that its expected policy
is unambiguous. The regression runs without SKIP and may crash the test
VM before a production fix; document this execution requirement.
Expose only private test entry points and task-scoped redirects; normal
build behavior is unchanged.
Link: https://github.com/SCST-project/scst/issues/367
Build kernel-matched images on GitHub-hosted runners and execute tests
under an external QEMU supervisor. Run KUnit and Ginkgo in independent
jobs that each build and test SCST. Keep guest images local to each job
and upload build logs and test reports.
Capture serial logs outside the guests, require complete matching
reports, and bound guest execution independently of kernel health.
Exercise guest panic and timeout handling before KUnit. Give Ginkgo an
isolated iSCSI peer and disposable block storage.
Print native test output and summaries in the job log. On failure, include
supervisor errors, kernel diagnostics and bounded serial tails while
retaining complete artifacts and the original test command exit status.
Select basic management and smoke SCSI/I/O tests on both transports for
pull requests. Run every Ginkgo spec after pushes to master and on manual
runs. Pass the label filter into the guest and require both transport
reports to confirm the requested selection.
Allow named sets of base labels and exact suite names in one TOML file.
Keep KUNIT_LABEL as the selection interface and combine overlapping sets
without running a suite twice. Include an IO set for CDB, UNMAP and VDISK.
Share expansion between source listing and runtime module selection.
Validate requested sets against the supplied module manifests before any
module operation, then load their owners and dependencies as before.
Reject namespace conflicts, nested sets and incomplete selections.
List descriptions and expanded suites without a build or loaded modules.
Allow an alternate file through --label-config, record selected definitions
in reports, and cover source listing, configuration and module ordering.
Read and preserve the native KTAP document for each suite after its run
write completes, under the same operation timeout. Validate the document
identity, plan and completeness independently of the kernel log.
Keep kernel log capture for diagnostics, retained fixtures and unexpected
execution. Preserve the stop and module ownership rules, and cover result
read failures, parameter diagnostics and complete results with an Oops.
Integrate iSCSI test objects in out-of-tree module builds.
Move transmit state names to a private header and link a separate
suite with task-scoped socket and completion boundaries.
Exercise data, padding and digest progress, retries, short sends and
TX_END completion. Preserve socket arguments and completion order
without creating a socket or initiator session.
Link a USER suite with private cleanup access and a task-scoped
pool-flush boundary. Check existing cleanup-yield behavior, post-unjam
flush ordering and session reply ownership without changing logic or
destroying real SGV pools.
Include all handler suites through the shared KUnit switch in external
module builds. Link the capacity suite as a separate object with private
access to the command dispatcher. Keep the access declarations available
to ordinary in-tree builds.
Check READ CAPACITY response bytes, queue geometry, short and split
buffers, and invalid CDBs using private fileio and nullio fixtures.
Bind the command CDB to its inline buffer and provide a private session
for allocation-failure status handling.
Add private access declarations and task-scoped boundaries for sysfs,
copy-manager admission, grace periods and blocking waits. Preserve
their original operations outside the current test task.
Share the existing ACG release-work layout through the private core
header so the worker and its separate test object use one definition.
Link separate lifecycle and blocker suites covering rollback, mapping
detach order, ACG worker locking and reference ownership. Cleanup
tolerates failed initialization and assertions.
Expose private functions to a separate test object and stub discovery,
registration and default-group lookup. Keep the actual update and
admission paths unchanged.
Check coalescing, failed inquiry, removal before retry and read-only
LUN rejection using private state.
Move the existing client layout into a private header and link
separate suites with shared fixtures. Add task-scoped usercopy and
allocation boundaries around the actual ioctl and timeout paths.
Use private clients without scheduling work or accessing userspace
memory. Preserve payload validation and counter behavior; the
delivered-timeout assertion exposes the existing double decrement.
Include the private event headers needed by ordinary in-tree builds
in generated kernel patches.
Exercise queue policy, barriers, sequence wrap, slot ownership and
concurrent producers through a private declaration of the existing
ordering function.
Keep worker memory outside KUnit-managed resources and pin the module
until completion. Bound teardown waits and report retained state when
a worker cannot finish.
Link a separate CDB test object with private access to command
parsing. Exercise tape and disk transfer decoding, REWIND and
initiator direction checks on private commands without altering
production behavior.
Provide private device, target-device and session state required by
command parsing, and optional logs of decoded direction expectations.
Give the separate UNMAP suite private access to the actual overlap
function. Check parser and consumer contracts without changing
validation or descriptor traversal.
Bind each command's CDB pointer to its private buffer and provide a
private session for allocation-failure status handling.
Use allocated guard descriptors to expose count violations safely.
Expect incomplete final descriptors to be ignored while preserving
complete descriptors, including when the CDB truncates the list. Stop
sense and descriptor checks if the parser returns an unexpected status.
Keep correct-result assertions for existing failures and explicitly skip
short-transfer cases that could read beyond the baseline buffer.
Exercise state transitions with unregistered groups, devices and
mappings. Check per-device callback delivery, ordering, optional
callbacks and unchanged or invalid states without changing ALUA
behavior.
Provide kunit-build for all test-owning modules and their dependencies,
kunit-run for existing artifacts, and kunit-test for a sequential build
and run even under make -j. Allow root builds and run every command with
the caller's privileges. Require root for module execution.
Map KUNIT_TEST and KUNIT_LOG to private Kbuild switches. Default
KUNIT_LABEL to ALL and use KUNIT_ARGS for other runner options and
module paths. Resolve artifacts from explicit arguments, configuration
or the recorded build, preserving spaces. Group and align the Makefile
help for component tests, KUnit and ordinary build targets.
Read label-to-suite mappings and dependency order from module metadata,
without a separate Python owner registry. Reject dependency cycles and
missing SCST core artifacts. Load external kernel dependencies with
modprobe before preparing KUnit; keep shared system
modules loaded. Load only selected SCST owners and their dependencies
from the supplied build and trigger suites through native KUnit debugfs.
Support built-in and modular KUnit with autorun disabled. Load modular
KUnit with known parameters when absent and release it after SCST
cleanup or a clean initial load failure. Reuse an existing instance only
after validating its effective parameters in sysfs; reject invalid or
unreadable values without changing the module. Never unload preloaded
KUnit. Check global filters before loading SCST.
Capture fresh kernel records and parse suites with the upstream KTAP
parser. Preserve logs and skip reasons, associating first-parameter
diagnostics with their case without changing plans or results. Stop
module operations on incomplete evidence, diagnostics or retained
fixtures. Continue after ordinary assertion failures. Finish capturing
output after command exit. Distinguish suites not started from missing
results, and count each Oops as one event. Print concise errors and
colored terminal statuses as suites finish. Group failure details after
progress. Normalize each assertion block independently of printk
messages while retaining value indentation. Follow with explicit stop
reasons and a compact SCST build summary. Reserve module headings,
author, license, source checksums, vermagic and other modules for
verbose output. Keep full case logs, module metadata and kernel
diagnostics in plain-text and JSON reports.
Cover build ordering, selection, kernel setup, dependency preparation,
runner lifecycle and reporting with mocked operations. Document VM
setup, build, execution and extension in the KUnit guide.
Add kunit-clean for test-owning component builds. Invalidate the recorded
module list and clear tooling caches on ordinary and component clean
paths too, including failed cleanup. Preserve reports and user settings.
Check all tooling, kunit-build and cleanup in one CI job. Pin the
Fedora container by digest and fetch a fixed kernel-devel package from
Koji with a SHA-256 check, independently of the regression matrix.
Save build evidence without building a kernel or loading modules.
Integrate optional native KUnit suites with out-of-tree SCST modules.
A single CONFIG_SCST_KUNIT_TEST switch includes all test objects of
each owner. Declare each suite name and label once and discover source
registrations for kunit-list without a build or loaded modules.
Preserve ordinary builds without KUnit.
Start with a fixed-wire LUN regression. Centralize private visibility
and task-scoped static-stub switches, and define retained-fixture
reporting for asynchronous tests. Use current native KUnit APIs
without compatibility shims. Keep optional execution messages behind
CONFIG_SCST_KUNIT_LOG while leaving failure diagnostics unconditional.
Add Makefile/Kbuild regression checks and document the shared switch.
Keep compatibility builds free of KUnit, including inherited test
options and allmodconfig. Generate ordinary in-tree SCST patches with
private declarations but without test suites or KUnit build options.
Check this boundary and preserve kernels without an unwinder option.
Gleb Chesnokov