target: Fix double-free of se_cmd in target_complete_tmr_failure
authorNicholas Bellinger <nab@linux-iscsi.org>
Fri, 26 Oct 2012 22:35:45 +0000 (15:35 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 5 Nov 2012 08:50:42 +0000 (09:50 +0100)
commit8c9c9dfcd1d31e2f149ea991f15bfdd4b5e1496e
tree5380dd7a7819ecf530531e5f130c837c745ba741
parent4bd1d456218f48e77be45feaadcacce29ce6e3ac
target: Fix double-free of se_cmd in target_complete_tmr_failure

commit e13d5fef88c40b87c8430f8274c3a9ca32ef90bc upstream.

Fabric drivers currently expect to internally release se_cmd in the event
of a TMR failure during target_submit_tmr(), which means the immediate call
to transport_generic_free_cmd() after TFO->queue_tm_rsp() from within
target_complete_tmr_failure() workqueue context is wrong.

This is done as some fabrics expect TMR operations to be acknowledged
before releasing the descriptor, so the assumption that core is releasing
se_cmd associated TMR memory is incorrect.  This fixes a OOPs where
transport_generic_free_cmd() was being called more than once.

This bug was originally observed with tcm_qla2xxx fabric ports.

Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Roland Dreier <roland@purestorage.com>
Cc: Andy Grover <agrover@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/target/target_core_transport.c