diff options
| author | Leon Romanovsky <leonro@nvidia.com> | 2026-07-22 09:30:10 +0300 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2026-07-28 21:52:09 -0400 |
| commit | a8ddfd2425bbbafadae8700d63ed8a61a4109878 (patch) | |
| tree | ad1c77b475ef6f7bbe7d8ead1ee4c29106686105 /include/linux/mfd/da9150 | |
| parent | b601fa590e667bd9643feed8c869b6b3e418480d (diff) | |
scsi: target: Clear cmd_cnt when initial counter enrollment fails
When target_get_sess_cmd() fails during session shutdown because
percpu_ref_tryget_live() returns false, the command keeps the
se_cmd->cmd_cnt pointer that __target_init_cmd() assigned earlier
without owning a reference. Final release through
target_release_cmd_kref() then issues an unmatched percpu_ref_put().
Commit 8e288be8606a ("scsi: target: Pass in cmd counter to use during
cmd setup") moved the cmd_cnt assignment ahead of the reference
acquisition. Clear se_cmd->cmd_cnt whenever the initial
target_get_sess_cmd() fails in target_init_cmd() and
target_submit_tmr(), so release performs exactly one matching put per
acquired reference.
Fixes: 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd setup")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Link: https://patch.msgid.link/20260722-reference-count-underflow-in-target-v1-1-63ab664f12fd@nvidia.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'include/linux/mfd/da9150')
0 files changed, 0 insertions, 0 deletions