• Nicholas Bellinger's avatar
    target: Drop incorrect ABORT_TASK put for completed commands · dce0c6b2
    Nicholas Bellinger authored
    commit 7f54ab5f upstream.
    
    This patch fixes a recent ABORT_TASK regression associated
    with commit febe562c, where a left-over target_put_sess_cmd()
    would still be called when __target_check_io_state() detected
    a command has already been completed, and explicit ABORT must
    be avoided.
    
    Note commit febe562c dropped the local kref_get_unless_zero()
    check in core_tmr_abort_task(), but did not drop this extra
    corresponding target_put_sess_cmd() in the failure path.
    
    So go ahead and drop this now bogus target_put_sess_cmd(),
    and avoid this potential use-after-free.
    Reported-by: default avatarDan Lane <dracodan@gmail.com>
    Cc: Quinn Tran <quinn.tran@qlogic.com>
    Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
    Cc: Sagi Grimberg <sagig@mellanox.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Hannes Reinecke <hare@suse.de>
    Cc: Andy Grover <agrover@redhat.com>
    Cc: Mike Christie <mchristi@redhat.com>
    Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    [ luis: backported to 3.16: adjusted context ]
    Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
    dce0c6b2
target_core_tmr.c 13.1 KB