| From 3fc9fb13a4b2576aeab86c62fd64eb29ab68659c Mon Sep 17 00:00:00 2001 |
| From: Nicholas Bellinger <nab@linux-iscsi.org> |
| Date: Fri, 27 Oct 2017 20:52:56 -0700 |
| Subject: iscsi-target: Fix non-immediate TMR reference leak |
| |
| From: Nicholas Bellinger <nab@linux-iscsi.org> |
| |
| commit 3fc9fb13a4b2576aeab86c62fd64eb29ab68659c upstream. |
| |
| This patch fixes a se_cmd->cmd_kref reference leak that can |
| occur when a non immediate TMR is proceeded our of command |
| sequence number order, and CMDSN_LOWER_THAN_EXP is returned |
| by iscsit_sequence_cmd(). |
| |
| To address this bug, call target_put_sess_cmd() during this |
| special case following what iscsit_process_scsi_cmd() does |
| upon CMDSN_LOWER_THAN_EXP. |
| |
| Cc: Mike Christie <mchristi@redhat.com> |
| Cc: Hannes Reinecke <hare@suse.com> |
| Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/target/iscsi/iscsi_target.c | 8 +++++--- |
| 1 file changed, 5 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/target/iscsi/iscsi_target.c |
| +++ b/drivers/target/iscsi/iscsi_target.c |
| @@ -1915,12 +1915,14 @@ attach: |
| |
| if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) { |
| int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn); |
| - if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP) |
| + if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP) { |
| out_of_order_cmdsn = 1; |
| - else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) |
| + } else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) { |
| + target_put_sess_cmd(&cmd->se_cmd); |
| return 0; |
| - else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) |
| + } else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) { |
| return -1; |
| + } |
| } |
| iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn)); |
| |
