Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd2f928b authored by Nicholas Bellinger's avatar Nicholas Bellinger
Browse files

target: Fix caw_sem leak in transport_generic_request_failure 



With the recent addition of transport_check_aborted_status() within
transport_generic_request_failure() to avoid sending a SCSI status
exception after CMD_T_ABORTED w/ TAS=1 has occured, it introduced
a COMPARE_AND_WRITE early failure regression.

Namely when COMPARE_AND_WRITE fails and se_device->caw_sem has
been taken by sbc_compare_and_write(), if the new check for
transport_check_aborted_status() returns true and exits,
cmd->transport_complete_callback() -> compare_and_write_post()
is skipped never releasing se_device->caw_sem.

This regression was originally introduced by:

  commit e3b88ee9
  Author: Bart Van Assche <bart.vanassche@sandisk.com>
  Date:   Tue Feb 14 16:25:45 2017 -0800

      target: Fix handling of aborted failed commands

To address this bug, move the transport_check_aborted_status()
call after transport_complete_task_attr() and
cmd->transport_complete_callback().

Cc: Mike Christie <mchristi@redhat.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: stable@vger.kernel.org # 4.11+
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 1c79df1f

drivers/target/target_core_transport.c

+4 −3
Original line number Original line Diff line number Diff line
@@ -1729,9 +1729,6 @@ void transport_generic_request_failure(struct se_cmd *cmd, 
{

{

	int ret = 0, post_ret = 0;

	int ret = 0, post_ret = 0;





	if (transport_check_aborted_status(cmd, 1))

		return;



	pr_debug("-----[ Storage Engine Exception; sense_reason %d\n",

	pr_debug("-----[ Storage Engine Exception; sense_reason %d\n",

		 sense_reason);

		 sense_reason);

	target_show_cmd("-----[ ", cmd);

	target_show_cmd("-----[ ", cmd);
@@ -1740,6 +1737,7 @@ void transport_generic_request_failure(struct se_cmd *cmd, 
	 * For SAM Task Attribute emulation for failed struct se_cmd

	 * For SAM Task Attribute emulation for failed struct se_cmd

	 */

	 */

	transport_complete_task_attr(cmd);

	transport_complete_task_attr(cmd);



	/*

	/*

	 * Handle special case for COMPARE_AND_WRITE failure, where the

	 * Handle special case for COMPARE_AND_WRITE failure, where the

	 * callback is expected to drop the per device ->caw_sem.

	 * callback is expected to drop the per device ->caw_sem.
@@ -1748,6 +1746,9 @@ void transport_generic_request_failure(struct se_cmd *cmd, 
	     cmd->transport_complete_callback)

	     cmd->transport_complete_callback)

		cmd->transport_complete_callback(cmd, false, &post_ret);

		cmd->transport_complete_callback(cmd, false, &post_ret);





	if (transport_check_aborted_status(cmd, 1))

		return;



	switch (sense_reason) {

	switch (sense_reason) {

	case TCM_NON_EXISTENT_LUN:

	case TCM_NON_EXISTENT_LUN:

	case TCM_UNSUPPORTED_SCSI_OPCODE:

	case TCM_UNSUPPORTED_SCSI_OPCODE: