target: Fix double-free of se_cmd in target_complete_tmr_failure
authorNicholas Bellinger <nab@linux-iscsi.org>
Fri, 26 Oct 2012 22:35:45 +0000 (15:35 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 5 Nov 2012 08:56:51 +0000 (09:56 +0100)
commit2ec0fe7bd41bd500e58702291edc5f7285ada81e
treee71352052c183342c4d3655d154a3e2bdae26a58
parentc7b3b9dff21b8beb7f3f49719b58495d4f744379
target: Fix double-free of se_cmd in target_complete_tmr_failure

commit e13d5fef88c40b87c8430f8274c3a9ca32ef90bc upstream.

Fabric drivers currently expect to internally release se_cmd in the event
of a TMR failure during target_submit_tmr(), which means the immediate call
to transport_generic_free_cmd() after TFO->queue_tm_rsp() from within
target_complete_tmr_failure() workqueue context is wrong.

This is done as some fabrics expect TMR operations to be acknowledged
before releasing the descriptor, so the assumption that core is releasing
se_cmd associated TMR memory is incorrect.  This fixes a OOPs where
transport_generic_free_cmd() was being called more than once.

This bug was originally observed with tcm_qla2xxx fabric ports.

Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Roland Dreier <roland@purestorage.com>
Cc: Andy Grover <agrover@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/target/target_core_transport.c