• Nicholas Bellinger's avatar
    target: Fix LUN_RESET active I/O handling for ACK_KREF · febe562c
    Nicholas Bellinger authored
    This patch fixes a NULL pointer se_cmd->cmd_kref < 0
    refcount bug during TMR LUN_RESET with active se_cmd
    I/O, that can be triggered during se_cmd descriptor
    shutdown + release via core_tmr_drain_state_list() code.
    
    To address this bug, add common __target_check_io_state()
    helper for ABORT_TASK + LUN_RESET w/ CMD_T_COMPLETE
    checking, and set CMD_T_ABORTED + obtain ->cmd_kref for
    both cases ahead of last target_put_sess_cmd() after
    TFO->aborted_task() -> transport_cmd_finish_abort()
    callback has completed.
    
    It also introduces SCF_ACK_KREF to determine when
    transport_cmd_finish_abort() needs to drop the second
    extra reference, ahead of calling target_put_sess_cmd()
    for the final kref_put(&se_cmd->cmd_kref).
    
    It also updates transport_cmd_check_stop() to avoid
    holding se_cmd->t_state_lock while dropping se_cmd
    device state via target_remove_from_state_list(), now
    that core_tmr_drain_state_list() is holding the
    se_device lock while checking se_cmd state from
    within TMR logic.
    
    Finally, move transport_put_cmd() release of SGL +
    TMR + extended CDB memory into target_free_cmd_mem()
    in order to avoid potential resource leaks in TMR
    ABORT_TASK + LUN_RESET code-paths.  Also update
    target_release_cmd_kref() accordingly.
    Reviewed-by: default avatarQuinn Tran <quinn.tran@qlogic.com>
    Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
    Cc: Sagi Grimberg <sagig@mellanox.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Hannes Reinecke <hare@suse.de>
    Cc: Andy Grover <agrover@redhat.com>
    Cc: Mike Christie <mchristi@redhat.com>
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    febe562c
target_core_transport.c 79.4 KB