]> Pileus Git - ~andy/linux/commit
[SCSI] tcm_fc: Fixing reference counting problem which was causing ft_sess to be...
authorKiran Patil <kiran.patil@intel.com>
Mon, 20 Jun 2011 23:59:41 +0000 (16:59 -0700)
committerJames Bottomley <JBottomley@Parallels.com>
Wed, 29 Jun 2011 21:32:31 +0000 (16:32 -0500)
commitf2f7b09ccea1717026915a4401f0452f05c97364
tree238d65acd5bc7771b2a7e96f4c8988c8fecc977e
parente3e65c69c3cfe8e407797c78fd11808aee1a8a81
[SCSI] tcm_fc: Fixing reference counting problem which was causing ft_sess to be deleted.

Problem: After fixing the issue in TCM core w.r.t LUN Reset (Task
Management request) , ran into issue where during the completing of
this LUN Reset command, reference count of "ft_sess" drops to zero
which caused "sess" to be deleted.

Fix: As part of handling task management request (e.g. LUN Reset), TCM
core function "transport_generic_do_tmr" ends up calling ft_free_cmd
which in turn calls "ft_sess_put" (which drops session's reference
count by 1) and then frees ft_cmd. Then function
"transport_generic_do_tmr" calls "transport_cmd_check_stop" which in
turn also calls ft_free_cmd (which calls ft_sess_put - which drops
reference count of sess by 1, hence reference count of sess becomes
zero and session gets deleted). Fix is to just send response in case
of tmr from function "ft_queue_resp_code" and not delete "ft_cmd"
(means don't call ft_free_cmd). Earlier code was to send the response
code and also free ft_cmd. ft_free_cmd will be freed later after
sending response code as a result of "transport_cmd_check_stop" (which
calls ft_release_cmd -> ft_free_cmd) being called from
"transport_generic_do_tmr" after sening TMR response code.

Notes/Dependencies: This bug was found after fixing NULL pointer
access issue in TCM core (in LUN Reset codepath)

Signed-off-by: Kiran Patil <kiran.patil@intel.com>
Signed-off-by: Robert Love <robert.w.love@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
drivers/target/tcm_fc/tfc_cmd.c