korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-27 06:04:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

target: fix potential race window in target_sess_cmd_list_waiting()

Browse Source 
target_sess_cmd_list_waiting() might hit on a condition where
the kref for the command is already 0, but the destructor has
not been called yet (or is stuck in waiting for a spin lock).
Rather than leaving the command on the list we should explicitly
remove it to avoid race issues later on.

Signed-off-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
This commit is contained in:
Hannes Reinecke 2016-08-22 10:54:07 +02:00 committed by Nicholas Bellinger
parent 61f36166c2
commit 1b4c59b7a1
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/target/target_core_transport.c
View File

@ -2535,7 +2535,9 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
* invocations before se_cmd descriptor release. * invocations before se_cmd descriptor release.
*/ */
if (ack_kref) { if (ack_kref) {
kref_get(&se_cmd->cmd_kref); if (!kref_get_unless_zero(&se_cmd->cmd_kref))
return -EINVAL;
se_cmd->se_cmd_flags |= SCF_ACK_KREF; se_cmd->se_cmd_flags |= SCF_ACK_KREF;
} }
@ -2616,7 +2618,7 @@ EXPORT_SYMBOL(target_put_sess_cmd);
*/ */
void target_sess_cmd_list_set_waiting(struct se_session *se_sess) void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
{ {
struct se_cmd *se_cmd; struct se_cmd *se_cmd, *tmp_cmd;
unsigned long flags; unsigned long flags;
int rc; int rc;
@ -2628,14 +2630,16 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
se_sess->sess_tearing_down = 1; se_sess->sess_tearing_down = 1;
list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list); list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);
list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) { list_for_each_entry_safe(se_cmd, tmp_cmd,
&se_sess->sess_wait_list, se_cmd_list) {
rc = kref_get_unless_zero(&se_cmd->cmd_kref); rc = kref_get_unless_zero(&se_cmd->cmd_kref);
if (rc) { if (rc) {
se_cmd->cmd_wait_set = 1; se_cmd->cmd_wait_set = 1;
spin_lock(&se_cmd->t_state_lock); spin_lock(&se_cmd->t_state_lock);
se_cmd->transport_state |= CMD_T_FABRIC_STOP; se_cmd->transport_state |= CMD_T_FABRIC_STOP;
spin_unlock(&se_cmd->t_state_lock); spin_unlock(&se_cmd->t_state_lock);
} } else
list_del_init(&se_cmd->se_cmd_list);
} }
spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);