diff options
| author | Roland Dreier <roland@purestorage.com> | 2013-01-02 21:47:59 +0100 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2013-01-11 06:00:36 +0100 |
| commit | 5a3b6fc0092c5f8dee7820064ee54d2631d48573 (patch) | |
| tree | acd4e983a76dbcd000a58e239d61ad50ddf90cd7 /drivers | |
| parent | target: Fix use-after-free in LUN RESET handling (diff) | |
| download | linux-5a3b6fc0092c5f8dee7820064ee54d2631d48573.tar.xz linux-5a3b6fc0092c5f8dee7820064ee54d2631d48573.zip | |
target: Release se_cmd when LUN lookup fails for TMR
When transport_lookup_tmr_lun() fails and we return a task management
response from target_complete_tmr_failure(), we need to call
transport_cmd_check_stop_to_fabric() to release the last ref to the
cmd after calling se_tfo->queue_tm_rsp(), or else we will never remove
the failed TMR from the session command list (and we'll end up waiting
forever when trying to tear down the session).
(nab: Fix minor compile breakage)
Signed-off-by: Roland Dreier <roland@purestorage.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/target/target_core_transport.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index 489bd1678d87..bd587b70661a 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1393,6 +1393,8 @@ static void target_complete_tmr_failure(struct work_struct *work) se_cmd->se_tmr_req->response = TMR_LUN_DOES_NOT_EXIST; se_cmd->se_tfo->queue_tm_rsp(se_cmd); + + transport_cmd_check_stop_to_fabric(se_cmd); } /** |