target: Drop incorrect ABORT_TASK put for completed commands

Nicholas Bellinger · Nicholas Bellinger · commit 7f54ab5ff52f · 2016-03-05T20:24:47.000-08:00
This patch fixes a recent ABORT_TASK regression associated with commit febe562, where a left-over target_put_sess_cmd() would still be called when __target_check_io_state() detected a command has already been completed, and explicit ABORT must be avoided. Note commit febe562 dropped the local kref_get_unless_zero() check in core_tmr_abort_task(), but did not drop this extra corresponding target_put_sess_cmd() in the failure path. So go ahead and drop this now bogus target_put_sess_cmd(), and avoid this potential use-after-free. Reported-by: Dan Lane <dracodan@gmail.com> Cc: Quinn Tran <quinn.tran@qlogic.com> Cc: Himanshu Madhani <himanshu.madhani@qlogic.com> Cc: Sagi Grimberg <sagig@mellanox.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Hannes Reinecke <hare@suse.de> Cc: Andy Grover <agrover@redhat.com> Cc: Mike Christie <mchristi@redhat.com> Cc: stable@vger.kernel.org # 3.14+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
@@ -177,7 +177,6 @@ void core_tmr_abort_task(
 
 		if (!__target_check_io_state(se_cmd, se_sess, 0)) {
 			spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-			target_put_sess_cmd(se_cmd);
 			goto out;
 		}
 		list_del_init(&se_cmd->se_cmd_list);

Original file line number	Diff line number	Diff line change
`@@ -177,7 +177,6 @@ void core_tmr_abort_task(`
`177`	`177`
`178`	`178`	`if (!__target_check_io_state(se_cmd, se_sess, 0)) {`
`179`	`179`	`spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);`
`180`		`- target_put_sess_cmd(se_cmd);`
`181`	`180`	`goto out;`
`182`	`181`	`}`
`183`	`182`	`list_del_init(&se_cmd->se_cmd_list);`