linux_dsm_epyc7002/drivers/target
Nicholas Bellinger efb2ea770b iscsi-target: Fix TMR reference leak during session shutdown
This patch fixes a iscsi-target specific TMR reference leak
during session shutdown, that could occur when a TMR was
quiesced before the hand-off back to iscsi-target code
via transport_cmd_check_stop_to_fabric().

The reference leak happens because iscsit_free_cmd() was
incorrectly skipping the final target_put_sess_cmd() for
TMRs when transport_generic_free_cmd() returned zero because
the se_cmd->cmd_kref did not reach zero, due to the missing
se_cmd assignment in original code.

The result was iscsi_cmd and it's associated se_cmd memory
would be freed once se_sess->sess_cmd_map where released,
but the associated se_tmr_req was leaked and remained part
of se_device->dev_tmr_list.

This bug would manfiest itself as kernel paging request
OOPsen in core_tmr_lun_reset(), when a left-over se_tmr_req
attempted to dereference it's se_cmd pointer that had
already been released during normal session shutdown.

To address this bug, go ahead and treat ISCSI_OP_SCSI_CMD
and ISCSI_OP_SCSI_TMFUNC the same when there is an extra
se_cmd->cmd_kref to drop in iscsit_free_cmd(), and use
op_scsi to signal __iscsit_free_cmd() when the former
needs to clear any further iscsi related I/O state.

Reported-by: Rob Millner <rlm@daterainc.com>
Cc: Rob Millner <rlm@daterainc.com>
Reported-by: Chu Yuan Lin <cyl@datera.io>
Cc: Chu Yuan Lin <cyl@datera.io>
Tested-by: Chu Yuan Lin <cyl@datera.io>
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2017-03-30 01:36:51 -07:00
..
iscsi iscsi-target: Fix TMR reference leak during session shutdown 2017-03-30 01:36:51 -07:00
loopback target: Minimize #include directives 2016-12-09 10:22:28 -08:00
sbp sbp-target: Add an #include directive 2016-12-09 10:20:10 -08:00
tcm_fc Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2017-03-02 14:52:05 -08:00
Kconfig block: make scsi_request and scsi ioctl support optional 2017-01-31 10:53:05 -07:00
Makefile target: Put TCMU under a new config option 2015-04-19 22:41:12 -07:00
target_core_alua.c target: fix race during implicit transition work flushes 2017-03-18 14:47:29 -07:00
target_core_alua.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_configfs.c target: Drop pointless tfo->check_stop_free check 2017-03-18 14:42:50 -07:00
target_core_device.c target: Fix NULL dereference during LUN lookup + active I/O shutdown 2017-02-26 16:08:44 -08:00
target_core_fabric_configfs.c fs: configfs: don't return anything from drop_link 2016-12-01 10:50:49 +01:00
target_core_fabric_lib.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2015-07-04 14:13:43 -07:00
target_core_file.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_file.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_hba.c target: Fix target_sense_desc_format NULL pointer dereference 2015-09-24 23:17:23 -07:00
target_core_iblock.c block,fs: use REQ_* flags directly 2016-11-01 09:43:26 -06:00
target_core_iblock.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_internal.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_pr.c locking/atomic, kref: Add kref_read() 2017-01-14 11:37:18 +01:00
target_core_pr.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_pscsi.c target: allow ALUA setup for some passthrough backends 2017-03-18 14:47:25 -07:00
target_core_pscsi.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_rd.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_rd.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_sbc.c target: Fix VERIFY_16 handling in sbc_parse_cdb 2017-03-07 22:15:23 -08:00
target_core_spc.c target: Remove enum transport_lunflags_table 2016-03-10 21:48:55 -08:00
target_core_stat.c target: Add counters for ABORT_TASK success + failure 2017-02-26 16:21:06 -08:00
target_core_tmr.c target: Add counters for ABORT_TASK success + failure 2017-02-26 16:21:06 -08:00
target_core_tpg.c target: allow ALUA setup for some passthrough backends 2017-03-18 14:47:25 -07:00
target_core_transport.c target: Drop pointless tfo->check_stop_free check 2017-03-18 14:42:50 -07:00
target_core_ua.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2015-07-04 14:13:43 -07:00
target_core_ua.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
target_core_user.c tcmu: Allow cmd_time_out to be set to zero (disabled) 2017-03-30 01:36:44 -07:00
target_core_xcopy.c target: Use correct SCSI status during EXTENDED_COPY exception 2017-02-08 07:46:54 -08:00
target_core_xcopy.h target: check for XCOPY parameter truncation 2017-01-10 08:41:27 -08:00