lkml.org 
[lkml]   [2016]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.16.y-ckt 119/142] target: Drop incorrect ABORT_TASK put for completed commands
    Date
    3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Nicholas Bellinger <nab@linux-iscsi.org>

    commit 7f54ab5ff52fb0b91569bc69c4a6bc5cac1b768d upstream.

    This patch fixes a recent ABORT_TASK regression associated
    with commit febe562c, where a left-over target_put_sess_cmd()
    would still be called when __target_check_io_state() detected
    a command has already been completed, and explicit ABORT must
    be avoided.

    Note commit febe562c dropped the local kref_get_unless_zero()
    check in core_tmr_abort_task(), but did not drop this extra
    corresponding target_put_sess_cmd() in the failure path.

    So go ahead and drop this now bogus target_put_sess_cmd(),
    and avoid this potential use-after-free.

    Reported-by: Dan Lane <dracodan@gmail.com>
    Cc: Quinn Tran <quinn.tran@qlogic.com>
    Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
    Cc: Sagi Grimberg <sagig@mellanox.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Hannes Reinecke <hare@suse.de>
    Cc: Andy Grover <agrover@redhat.com>
    Cc: Mike Christie <mchristi@redhat.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [ luis: backported to 3.16: adjusted context ]
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    drivers/target/target_core_tmr.c | 1 -
    1 file changed, 1 deletion(-)

    diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
    index ebdbaaf6111d..033a59cd6c70 100644
    --- a/drivers/target/target_core_tmr.c
    +++ b/drivers/target/target_core_tmr.c
    @@ -186,7 +186,6 @@ void core_tmr_abort_task(

    if (!__target_check_io_state(se_cmd, se_sess, 0)) {
    spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
    - target_put_sess_cmd(se_sess, se_cmd);
    goto out;
    }

    \
     
     \ /
      Last update: 2016-03-22 12:21    [W:4.149 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site