Commit 5e2c956b authored by Nicholas Bellinger's avatar Nicholas Bellinger

target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP

During transport_generic_free_cmd() with a concurrent TMR
ABORT_TASK and shutdown CMD_T_FABRIC_STOP bit set, the
caller will be blocked on se_cmd->cmd_wait_stop completion
until the final kref_put() -> target_release_cmd_kref()
has been invoked to call complete().

However, when ABORT_TASK is completed with FUNCTION_COMPLETE
in core_tmr_abort_task(), the aborted se_cmd will have already
been removed from se_sess->sess_cmd_list via list_del_init().

This results in target_release_cmd_kref() hitting the
legacy list_empty() == true check, invoking ->release_cmd()
but skipping complete() to wakeup se_cmd->cmd_wait_stop
blocked earlier in transport_generic_free_cmd() code.

To address this bug, it's safe to go ahead and drop the
original list_empty() check so that fabric_stop invokes
the complete() as expected, since list_del_init() can
safely be used on a empty list.

Cc: Mike Christie <>
Cc: Quinn Tran <>
Cc: Himanshu Madhani <>
Cc: Christoph Hellwig <>
Cc: Hannes Reinecke <>
Cc: # 3.14+
Tested-by: default avatarNicholas Bellinger <>
Signed-off-by: default avatarNicholas Bellinger <>
parent af8c34ce
...@@ -2557,12 +2557,6 @@ static void target_release_cmd_kref(struct kref *kref) ...@@ -2557,12 +2557,6 @@ static void target_release_cmd_kref(struct kref *kref)
bool fabric_stop; bool fabric_stop;
spin_lock_irqsave(&se_sess->sess_cmd_lock, flags); spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
if (list_empty(&se_cmd->se_cmd_list)) {
spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
spin_lock(&se_cmd->t_state_lock); spin_lock(&se_cmd->t_state_lock);
fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP); fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment