| From 9b2792c3da1e80f2d460167d319302a24c9ca2b7 Mon Sep 17 00:00:00 2001 |
| From: Nicholas Bellinger <nab@linux-iscsi.org> |
| Date: Mon, 6 Feb 2017 14:28:09 -0800 |
| Subject: [PATCH] target: Fix COMPARE_AND_WRITE ref leak for non GOOD status |
| |
| commit 9b2792c3da1e80f2d460167d319302a24c9ca2b7 upstream. |
| |
| This patch addresses a long standing bug where the commit phase |
| of COMPARE_AND_WRITE would result in a se_cmd->cmd_kref reference |
| leak if se_cmd->scsi_status returned non SAM_STAT_GOOD. |
| |
| This would manifest first as a lost SCSI response, and eventual |
| hung task during fabric driver logout or re-login, as existing |
| shutdown logic waited for the COMPARE_AND_WRITE se_cmd->cmd_kref |
| to reach zero. |
| |
| To address this bug, compare_and_write_post() has been changed |
| to drop the incorrect !cmd->scsi_status conditional that was |
| preventing *post_ret = 1 for being set during non SAM_STAT_GOOD |
| status. |
| |
| This patch has been tested with SAM_STAT_CHECK_CONDITION status |
| from normal target_complete_cmd() callback path, as well as the |
| incoming __target_execute_cmd() submission failure path when |
| se_cmd->execute_cmd() returns non zero status. |
| |
| Reported-by: Donald White <dew@datera.io> |
| Cc: Donald White <dew@datera.io> |
| Tested-by: Gary Guo <ghg@datera.io> |
| Cc: Gary Guo <ghg@datera.io> |
| Reviewed-by: Christoph Hellwig <hch@lst.de> |
| Cc: <stable@vger.kernel.org> # v3.12+ |
| Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> |
| |
| diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c |
| index 4879e70e2eef..df7b6e95c019 100644 |
| --- a/drivers/target/target_core_sbc.c |
| +++ b/drivers/target/target_core_sbc.c |
| @@ -451,6 +451,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, |
| int *post_ret) |
| { |
| struct se_device *dev = cmd->se_dev; |
| + sense_reason_t ret = TCM_NO_SENSE; |
| |
| /* |
| * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through |
| @@ -458,9 +459,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, |
| * sent to the backend driver. |
| */ |
| spin_lock_irq(&cmd->t_state_lock); |
| - if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) { |
| + if (cmd->transport_state & CMD_T_SENT) { |
| cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST; |
| *post_ret = 1; |
| + |
| + if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION) |
| + ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; |
| } |
| spin_unlock_irq(&cmd->t_state_lock); |
| |
| @@ -470,7 +474,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, |
| */ |
| up(&dev->caw_sem); |
| |
| - return TCM_NO_SENSE; |
| + return ret; |
| } |
| |
| static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success, |
| -- |
| 2.12.0 |
| |