Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1b4c59b7 authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Nicholas Bellinger
Browse files

target: fix potential race window in target_sess_cmd_list_waiting() 



target_sess_cmd_list_waiting() might hit on a condition where
the kref for the command is already 0, but the destructor has
not been called yet (or is stuck in waiting for a spin lock).
Rather than leaving the command on the list we should explicitly
remove it to avoid race issues later on.

Signed-off-by: default avatarHannes Reinecke <hare@suse.com>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 61f36166

drivers/target/target_core_transport.c

+8 −4
Original line number Diff line number Diff line
@@ -2535,7 +2535,9 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref) 
	 * invocations before se_cmd descriptor release.

	 */

	if (ack_kref) {

		kref_get(&se_cmd->cmd_kref);

		if (!kref_get_unless_zero(&se_cmd->cmd_kref))

			return -EINVAL;



		se_cmd->se_cmd_flags |= SCF_ACK_KREF;

	}
@@ -2616,7 +2618,7 @@ EXPORT_SYMBOL(target_put_sess_cmd); 
 */

void target_sess_cmd_list_set_waiting(struct se_session *se_sess)

{

	struct se_cmd *se_cmd;

	struct se_cmd *se_cmd, *tmp_cmd;

	unsigned long flags;

	int rc;
@@ -2628,14 +2630,16 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess) 
	se_sess->sess_tearing_down = 1;

	list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);



	list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) {

	list_for_each_entry_safe(se_cmd, tmp_cmd,

				 &se_sess->sess_wait_list, se_cmd_list) {

		rc = kref_get_unless_zero(&se_cmd->cmd_kref);

		if (rc) {

			se_cmd->cmd_wait_set = 1;

			spin_lock(&se_cmd->t_state_lock);

			se_cmd->transport_state |= CMD_T_FABRIC_STOP;

			spin_unlock(&se_cmd->t_state_lock);

		}

		} else

			list_del_init(&se_cmd->se_cmd_list);

	}



	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);