The basic-or-smoke PR filter selects 67 specs. Recent successful PR
runs spent more than 41 minutes executing their VM tests, in addition
to image preparation. Broad functional labels keep growing this set
whenever a new basic or smoke regression is added.
Select explicit pr-labelled specs instead: 11 local and 8 iSCSI cases.
Keep representative device, target, LUN and group management, repeated
configuration application, failed fileio creation, discovery and login,
MD5/SHA256 CHAP, portal validation, READ CAPACITY, read-only rejection,
and verified fileio/blockio I/O. Preserve each test's workload, assertions
and cleanup. Exclude manual, race and stress scenarios from the PR set.
The master and manual selections remain 103 and 106 specs respectively.
Limit the complete PR job to 30 minutes, its image build to 10 minutes
and VM execution to 18 minutes. Preserve the longer push/manual limits.
The intended end-to-end PR duration is 15-20 minutes; confirm it on CI
rather than treating dry-run counts as runtime evidence.
Validate selection in the Go runner and Python VM supervisor tests.
Framework checks, all 59 CI tests, actionlint and selection dry runs pass.
Manual review found a use-after-free in internal_portal validation; no
saved analyzer diagnostic directly reports this aliasing case. portal
points inside the allocation owned by portals, but the error branch
frees portals before passing portal to the logging function.
Keep the allocation alive until the invalid address has been logged.
Preserve the existing EINVAL response and cleanup path.
Add a Ginkgo management regression through scstadmin. Reject a list
starting with an invalid token, check that the daemon log contains the
intact token, and verify daemon liveness and the unchanged setting.
Manual review found missing bounds checks in print_scn_pdu and
qry_rsp_handle; no saved analyzer diagnostic directly reports these
bugs. Both handlers read a TLV header before proving it is present.
Clamping an oversized value can underflow the remaining length or
accept a truncated attribute. Query handling also reads a missing
status word and can discard the old ACL before noticing bad input.
Validate every TLV header, value length and alignment before processing
any attributes. Check and decode the response status in host byte order.
Reject malformed tails before modifying names or replacing the ACL.
Add an isolated Ginkgo probe of both production handlers with payloads
ending at a guard page. Cover short headers/status, oversized and
unaligned values, malformed tails, delimiters and valid ACL replacement.
Manual review found that chap_rand ignores read errors and short reads,
then returns a partially or wholly uninitialized integer. No saved
analyzer diagnostic directly reports this defect. A negative signed
value can also reduce the intended 25-to-49-byte challenge length.
Read a complete unsigned value, retry EINTR and return failures to the
caller. Reject challenge creation on entropy failure and free a partial
challenge before returning, without publishing CHAP_C.
Add an isolated Ginkgo suite using the production CHAP implementation
with deterministic entropy I/O. Cover length bounds, interrupted and
short reads, open/read failures, EOF and partial-challenge cleanup.
Prepare interface headers privately so probes need no preceding build.
Reserve the legacy-kernel fork checks for manual runs instead of adding
two VM jobs and extra kernel builds to the regular CI selection. Remove
the Linux 5.8/5.9 Ginkgo jobs and regression matrix entries, retaining the
kernel pins and local-only VM runner for reproduction.
Label the fork spec manual and exclude that label from both ci-pr and
ci-push. Move smoke to the READ CAPACITY entries so their existing CI
coverage remains intact. Keep full manual runs inclusive, update the
selection checks, and document focused manual execution.
Extend the scst_user fault hook with a fork action: once armed, the
handler fork()s before its next scst_user ioctl, and the child only
sleeps, as a crash reporter, system() or popen() would. The new spec
reads LBA 0 first, so the handler's cached buffer holds known data,
then makes the handler fork. Afterwards READ CAPACITY(10) and (16),
reads and writes must return the right geometry and data.
The hook logs its success line only after the fault was applied, and
logs a failed fork() with its errno. The specs fail on that line and
require each fault's success line, so a failed fork() cannot pass as a
handler that forked.
Before Linux 5.9, the same boundary as dev_user_map_buf(), scst_user
keeps get_user_pages() and a handler that forks must use MADV_DONTFORK,
which fileio_tgt does not. There the hook applies MADV_DONTFORK to every
active data buffer before it forks and logs how many it protected. It
tracks the buffers from the handler's ALLOC_MEM and EXEC replies, and
restores MADV_DOFORK before the handler frees one. The spec requires
that line below 5.9 and its absence from 5.9, and the same correct
geometry and data on every kernel. So 5.9 and later test the pin
alone, and older kernels test the documented MADV_DONTFORK requirement.
Without pinned buffers SCST keeps reading the pre-fork page, and the
next READ CAPACITY reports the stale data block as its block length.
Run usr/fileio/fileio_tgt over scst_local with an LD_PRELOAD hook that
replaces the block length of one READ CAPACITY(10) or (16) reply with
809052976, as a user space backend did in production. The invalid reply
must be rejected with INTERNAL TARGET FAILURE sense, and afterwards READ
CAPACITY(10) and (16), reads and writes must return the right geometry
and data.
The local suite now builds usr and loads scst_user, and the CI image
builds usr for the Ginkgo guest.
Keep CI selection policy in shared ci-pr and ci-push label sets. Resolve
them to ordinary Ginkgo expressions for local discovery and execution,
and before booting CI guests so report validation still checks the exact
filter. Preserve ordinary expressions and the full manual selection.
Mark both ACG teardown scenarios as race and exclude that category from
master push runs. Keep their strict overlap, recovery and cleanup checks
unchanged. PR runs retain basic/smoke coverage through ci-pr.
Document the named selections and check their filtering behavior and
propagation through the VM supervisor.
Remove the issue #367 walkthrough from the KUnit guide and the smoke and
SCSI case lists from the Ginkgo guide. Keep scenario expectations with
the tests instead of duplicating them in runner documentation.
Retain label selection, environment requirements and artifact guidance.
Describe optional kernel-log collection without tying it to an issue.
Task-management initialization reads sess->acg before acquiring activity
protection. A concurrent reassignment can clear this pointer and later
drop the old ACG reference, so the read can dereference NULL or freed
storage even while ordinary command processing is suspended.
Keep a session-owned copy of the black-hole mode and read it with
READ_ONCE() in the TM path. Initialize it before admitting session work,
retain the old mode while replacing LUNs, and publish the new mode when
installing the new ACG. Update existing sessions on sysfs writes as well.
All writers hold scst_mutex and use WRITE_ONCE(); the TM command already
owns a session reference, so no additional locking or ACG reference is
needed for this scalar policy read.
Read the previous sysfs value under the same mutex so concurrent stores
cannot mistake a real change for a no-op and leave session copies stale.
Extend the private TM tests with sysfs mode transitions, rejected writes,
and old/new drop-policy checks inside and after real reassignment.
Remove the dedicated Ginkgo opt-in and Skip path now that the fix is
in place, so both teardown scenarios run whenever their labels are
selected, including full CI runs.
Link: https://github.com/SCST-project/scst/issues/367
Add opt-in issue-367 scenarios that move a fixture initiator between
disjoint LUN maps alongside logout or an exact TCP socket reset. Wait
for a fresh kernel reassignment message naming the initiator and groups
before requesting teardown, and require overlapping command intervals.
Verify group ownership, recovery and session cleanup after each move.
Capture new kernel records, reject diagnostics or incomplete evidence,
and preserve the target when teardown cannot be justified. Require an
explicit profile option even when all Ginkgo labels are selected.
Test socket selection, log observation and opt-in configuration.
The scenarios use nullio and do not implement a production fix or a
duplicate-IQN login generator. Kernel-observed reassignment and command
overlap do not prove that TM entered the NULL-ACG window; a successful
run means not reproduced.
Link: https://github.com/SCST-project/scst/issues/367
Build kernel-matched images on GitHub-hosted runners and execute tests
under an external QEMU supervisor. Run KUnit and Ginkgo in independent
jobs that each build and test SCST. Keep guest images local to each job
and upload build logs and test reports.
Capture serial logs outside the guests, require complete matching
reports, and bound guest execution independently of kernel health.
Exercise guest panic and timeout handling before KUnit. Give Ginkgo an
isolated iSCSI peer and disposable block storage.
Print native test output and summaries in the job log. On failure, include
supervisor errors, kernel diagnostics and bounded serial tails while
retaining complete artifacts and the original test command exit status.
Select basic management and smoke SCSI/I/O tests on both transports for
pull requests. Run every Ginkgo spec after pushes to master and on manual
runs. Pass the label filter into the guest and require both transport
reports to confirm the requested selection.
The UNMAP parser reads the descriptor length before checking that the
parameter header is present, and bounds descriptor reads by the CDB
length without checking the available SG data. A nonzero CDB length with
no buffer also succeeds silently. Reject short headers and transfers with
PARAMETER LIST LENGTH ERROR before reading any parameter data, while
preserving the zero-length command as a no-op.
SBC-3 section 5.26.2 requires an incomplete final UNMAP descriptor to be
ignored. The current multiple-of-16 check instead rejects the entire
command. Parse only complete descriptors within both the advertised
descriptor length and the CDB parameter length, as Linux target does.
Bound allocation and traversal by that same descriptor count.
Keep the existing KUnit expectations and enable the six short-transfer
cases previously skipped to avoid out-of-bounds reads. Add coverage for
zero-length CDBs with extra SG data, truncated headers across SG entries,
partial final descriptors and oversized descriptor-length fields. Fill
input descriptors independently of the expected output count.
Add shared Ginkgo cases over scst_local and TCP iSCSI using temporary
thin-provisioned fileio LUNs. Check target sense for short headers and
read back seeded ranges and guards to detect ignored valid descriptors,
unwanted discards and incomplete descriptors processed as complete ones.
Probe hole punching before export because fileio does not promise LBPRZ.
Keep SG_IO and CDB transfer lengths equal in these integration cases;
missing or split SG data remains covered by KUnit.
Fixes: 3b57904da6 ("Unify parsing of descriptors-based and internal commands")
Dynamic attributes can contain CHAP secrets. Administrative update,
duplicate, removal and debug messages currently print their values,
exposing them in captured command output.
Report the operation and attribute name without the value in both
the CLI and Perl library. Keep metadata-driven discovery and explicit
privileged queries unchanged.
Add a Ginkgo case that checks add, duplicate, remove, missing-value
and debug output through the real scstadmin. Query the newly created
attribute explicitly to confirm that the synthetic secret was stored
before checking that the update output omits it.
Link: https://github.com/SCST-project/scst/issues/91
Saved configurations contain CHAP secrets. Opening a new output with
the caller's umask can make those secrets readable by other users.
Truncating an existing readable file also leaves its access mode
unchanged while the new contents are written.
Create outputs with mode 0600 and restrict existing files before
truncating them. Require an owned regular file, reject symbolic links
and report preparation, flush, sync and close failures. Keep the
original secret in the configuration because CHAP needs it.
Add Ginkgo coverage through the real scstadmin for new and existing
0644, 0640 and 0600 outputs and for symlink rejection. Run the writer
with umask 022 and probe access after dropping to UID/GID 65534, using
public and private control files to validate the probe itself.
Link: https://github.com/SCST-project/scst/issues/91
The fio profile uses a final explicit synchronization, which can hide
an ignored FUA from issue #395. Send WRITE(10/16) FUA commands followed
by readback before any later cache command instead.
Share the protocol cases between local and iSCSI fixtures. Cover explicit
SYNCHRONIZE CACHE(10/16) ranges, zero-length-to-end and IMMED, using
nonzero offsets and one-block/cross-page transfers on sparse owned files.
Cover buffered synchronous/asynchronous I/O and asynchronous direct I/O
with 512/4096-byte sectors. Reject direct synchronous profiles before
creating a backing file: vdisk_fileio does not support that combination.
Add write-through and nonvolatile-cache FUA controls, keeping them out
of the separate unfixed commandless cache-bypass path.
Unit-test literal CDB bytes, range overflow, command order, data phases,
failed commands, corrupt readback and backend profile attributes without
storage access. These tests check the command contract and payload;
persistence after a crash remains a separate test-harness task.
Link: https://github.com/SCST-project/scst/issues/395
The sysfs sync regression in issue #394 originates in
commit 530af782ed ("scst_vdisk: Add 'sync' sysfs attribute").
It dereferenced a closed file. Require a management rejection for inactive
devices, the last detach and ALUA states that close the backend, then
verify recovery.
Remove only the fixture device's internal copy-manager mappings when
checking the last attachment: an external LUN count alone does not prove
that the backend is closed. Use an explicit local session for successful
sync and preserve unrelated devices. Put session LUNs in an explicit
initiator group because scstadmin does not report the default group map
in its session listing.
Drop the temporary known-crash label, opt-in setting and example filter.
The inactive-sync regression now belongs to the default basic selection.
Link: https://github.com/SCST-project/scst/issues/394
Run one fio profile with concurrent 4K, 64K and 128K jobs in disjoint
regions. Cover buffered fileio with 512-byte sectors and direct blockio
with 4K sectors. Verify CRC32C data and completed byte counts, and follow
buffered I/O with direct verification to bypass the initiator page cache.
Reuse the SCSI fixtures and exported-device checks for both transports.
Require an explicit target block device and check its use and signatures
before exporting it. Configure the per-job region size and I/O timeout,
and retain rendered job files, JSON reports and stderr.
Cover job rendering and report validation with framework tests. Document
fio prerequisites, destructive scope and label selection through the
common Make targets.
Add shared sg3_utils scenarios for scst_local and iSCSI exports: inquiry
and VPD identity, capacity, LUN visibility, write protection and invalid
LBA handling. Require the expected SCSI status and raw sense for rejected
commands, then verify that valid reads still work.
Use temporary fileio backends with 512-byte sectors. Keep fixture
identifiers within vdisk's 20-character USN limit. Match each exported
device to its fixture by identity and geometry before submitting commands.
Carry binary responses over the existing supervised command transports
and retain fixture ownership through successful cleanup.
Add framework checks for response parsing, device selection and command
interruption. Document tool prerequisites and the scsi label for both
transports through the common Make targets.
Run Ginkgo on the target and drive a separate Open-iSCSI initiator over
SSH. Keep host locks, bounded command logs and failure latches on both
sides. Load checkout modules, own the foreground target daemon, and
remove sessions and node records before tearing down target resources.
Add discovery, login/logout, repeated login, portal filtering and CHAP
scenarios. Offer each CHAP algorithm separately and verify recovery after
an authentication rejection. Use dummy LUNs and per-run initiator IQNs
without changing the initiator's global configuration.
Register the iSCSI group with the shared runner and validate every
selected host before starting the first suite. Finish local teardown
before starting iSCSI tests and stop after any suite failure. Extend the
configuration examples and guide with initiator setup and cleanup limits.
Cover fileio activation and configuration persistence, local ALUA state
changes, relative target IDs, live-session group changes and copy-manager
rollback through scstadmin. Manage temporary backing files with device
cleanup and assert the session LUN maps exposed by the CLI.
Add configurable group/device churn and many-LUN teardown scenarios.
Keep the inactive-fileio sync reproducer behind an explicit opt-in
because it can crash affected kernels. Document the new configuration
options and test labels.
Add component tests for the scstadmin management interface, including
state preservation after rejected commands. Use scst_local and
vdisk_nullio to cover devices, targets, LUN mappings, initiator groups,
ALUA and configuration save/restore without physical storage.
Provide a shared runner with explicit configuration, host locking,
bounded command logs and JSON/JUnit reports. Select specs through labels
and focus before preparing the host, and reject empty selections. Parse
scstadmin output, including session attributes and LUN mappings, through
common helpers covered by framework tests.
Load checkout modules in suite setup, optionally build them first, and
unload them after successful cleanup. Add common Make targets for
framework checks, test selection and live runs, with setup documentation.
Gleb Chesnokov
wenlxieandGleb Chesnokov