Commit 02dd4914 authored by Mike Christie's avatar Mike Christie Committed by Martin K. Petersen
Browse files

scsi: target: Fix cmd_count ref leak 

percpu_ref_init sets the refcount to 1 and percpu_ref_kill drops it.
Drivers like iSCSI and loop do not call target_sess_cmd_list_set_waiting
during session shutdown, though, so they have been calling percpu_ref_exit
with a refcount still taken and leaking the cmd_counts memory.

Link: https://lore.kernel.org/r/1604257174-4524-3-git-send-email-michael.christie@oracle.com


Reviewed-by: default avatarHimanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: default avatarMike Christie <michael.christie@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent a2b5d6f9

drivers/target/target_core_transport.c

+8 −0
Original line number Diff line number Diff line
@@ -238,6 +238,14 @@ EXPORT_SYMBOL(transport_init_session); 


void transport_uninit_session(struct se_session *se_sess)

{

	/*

	 * Drivers like iscsi and loop do not call

	 * target_sess_cmd_list_set_waiting during session shutdown so we

	 * have to drop the ref taken at init time here.

	 */

	if (!se_sess->sess_tearing_down)

		percpu_ref_put(&se_sess->cmd_count);



	percpu_ref_exit(&se_sess->cmd_count);

}