Joern Engel cf141ccaf0 target: close target_put_sess_cmd() vs. core_tmr_abort_task() race ...

BugLink: http://bugs.launchpad.net/bugs/1187551

commit ccf5ae83a6 upstream.

It is possible for one thread to to take se_sess->sess_cmd_lock in
core_tmr_abort_task() before taking a reference count on
se_cmd->cmd_kref, while another thread in target_put_sess_cmd() drops
se_cmd->cmd_kref before taking se_sess->sess_cmd_lock.

This introduces kref_put_spinlock_irqsave() and uses it in
target_put_sess_cmd() to close the race window.

Signed-off-by: Joern Engel <joern@logfs.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Steve Conklin <sconklin@canonical.com>

2013-06-07 11:43:04 -05:00

..

iscsi

iscsi-target: Fix processing of OOO commands

2013-06-07 11:42:59 -05:00

loopback

target: kill struct se_subsystem_dev

2012-11-06 20:55:43 -08:00

sbp

sbp-target: fix error path in sbp_make_tpg()

2012-12-12 21:17:25 -08:00

tcm_fc

tcm_fc: Do not report target role when target is not defined

2013-01-10 20:08:58 -08:00

Kconfig

sbp-target: Initial merge of firewire/ieee-1394 target mode support

2012-05-09 15:25:17 -07:00

Makefile

target: move code for CDB emulation

2012-07-16 17:27:45 -07:00

target_core_alua.c

target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs

2013-04-17 06:41:35 -06:00

target_core_alua.h

target: pass sense_reason as a return value

2012-11-06 20:55:46 -08:00

target_core_configfs.c

target/configfs: use kmalloc() instead of kzalloc() for default groups

2012-11-27 22:49:24 -08:00

target_core_device.c

target: Fix lookup of dynamic NodeACLs during cached demo-mode operation

2013-03-04 06:03:34 +08:00

target_core_fabric_configfs.c

target: Add missing mapped_lun bounds checking during make_mappedlun setup

2013-03-04 06:03:34 +08:00

target_core_fabric_lib.c

target: Update copyright information to 2012

2012-11-27 22:47:02 -08:00

target_core_file.c

target: Use FD_MAX_SECTORS/FD_BLOCKSIZE for blockdevs using fileio

2013-06-07 11:42:58 -05:00

target_core_file.h

target/file: Bump FD_MAX_SECTORS to 2048 to handle 1M sized I/Os

2013-03-28 12:17:48 -07:00

target_core_hba.c

target: Update copyright information to 2012

2012-11-27 22:47:02 -08:00

target_core_iblock.c

target: Make spc_get_write_same_sectors return sector_t

2012-11-27 22:49:25 -08:00

target_core_iblock.h

target: kill struct se_subsystem_dev

2012-11-06 20:55:43 -08:00

target_core_internal.h

target: Fix lookup of dynamic NodeACLs during cached demo-mode operation

2013-03-04 06:03:34 +08:00

target_core_pr.c

target: Use TCM_NO_SENSE for initialisation

2013-01-10 20:07:10 -08:00

target_core_pr.h

target: pass sense_reason as a return value

2012-11-06 20:55:46 -08:00

target_core_pscsi.c

target/pscsi: Fix page increment

2013-03-14 11:26:10 -07:00

target_core_pscsi.h

target: kill struct se_subsystem_dev

2012-11-06 20:55:43 -08:00

target_core_rd.c

target: Update copyright information to 2012

2012-11-27 22:47:02 -08:00

target_core_rd.h

target: kill struct se_subsystem_dev

2012-11-06 20:55:43 -08:00

target_core_sbc.c

target: Fix zero-length READ_CAPACITY_16 regression

2013-01-29 14:24:26 -08:00

target_core_spc.c

target: Fix zero-length MODE_SENSE regression

2013-01-29 14:24:20 -08:00

target_core_stat.c

target: Update copyright information to 2012

2012-11-27 22:47:02 -08:00

target_core_tmr.c

target: Update copyright information to 2012

2012-11-27 22:47:02 -08:00

target_core_tpg.c

target: Fix lookup of dynamic NodeACLs during cached demo-mode operation

2013-03-04 06:03:34 +08:00

target_core_transport.c

target: close target_put_sess_cmd() vs. core_tmr_abort_task() race

2013-06-07 11:43:04 -05:00

target_core_ua.c

target: Update copyright information to 2012

2012-11-27 22:47:02 -08:00

target_core_ua.h

target: pass sense_reason as a return value

2012-11-06 20:55:46 -08:00