diff options
| author | Nicholas Bellinger <nab@linux-iscsi.org> | 2016-05-25 22:25:04 +0300 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2016-08-22 19:23:13 +0300 |
| commit | b4a8ca6b17a7994dedb0d9eb07e9bf85dacd6f7e (patch) | |
| tree | 43d3cbbeea1bd2350a99711397188860ea8fdece /drivers/target | |
| parent | bdcbb05998d007026c48b0b5cb77733bf6e20c3d (diff) | |
| download | linux-b4a8ca6b17a7994dedb0d9eb07e9bf85dacd6f7e.tar.xz | |
target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP
[ Upstream commit 5e2c956b8aa24d4f33ff7afef92d409eed164746 ]
During transport_generic_free_cmd() with a concurrent TMR
ABORT_TASK and shutdown CMD_T_FABRIC_STOP bit set, the
caller will be blocked on se_cmd->cmd_wait_stop completion
until the final kref_put() -> target_release_cmd_kref()
has been invoked to call complete().
However, when ABORT_TASK is completed with FUNCTION_COMPLETE
in core_tmr_abort_task(), the aborted se_cmd will have already
been removed from se_sess->sess_cmd_list via list_del_init().
This results in target_release_cmd_kref() hitting the
legacy list_empty() == true check, invoking ->release_cmd()
but skipping complete() to wakeup se_cmd->cmd_wait_stop
blocked earlier in transport_generic_free_cmd() code.
To address this bug, it's safe to go ahead and drop the
original list_empty() check so that fabric_stop invokes
the complete() as expected, since list_del_init() can
safely be used on a empty list.
Cc: Mike Christie <mchristi@redhat.com>
Cc: Quinn Tran <quinn.tran@qlogic.com>
Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: stable@vger.kernel.org # 3.14+
Tested-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Diffstat (limited to 'drivers/target')
| -rw-r--r-- | drivers/target/target_core_transport.c | 7 |
1 files changed, 0 insertions, 7 deletions
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index 1a487f9c2f78..4bcfa97b47e3 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -2451,13 +2451,6 @@ static void target_release_cmd_kref(struct kref *kref) struct se_session *se_sess = se_cmd->se_sess; bool fabric_stop; - if (list_empty(&se_cmd->se_cmd_list)) { - spin_unlock(&se_sess->sess_cmd_lock); - target_free_cmd_mem(se_cmd); - se_cmd->se_tfo->release_cmd(se_cmd); - return; - } - spin_lock(&se_cmd->t_state_lock); fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP); spin_unlock(&se_cmd->t_state_lock); |