diff options
| author | Quinn Tran <[email protected]> | 2014-09-25 06:22:28 -0400 |
|---|---|---|
| committer | Nicholas Bellinger <[email protected]> | 2014-10-01 14:39:30 -0700 |
| commit | 082f58ac4a48d3f5cb4597232cb2ac6823a96f43 (patch) | |
| tree | 8a71ac3e9bc7102202e0a1cd5a1c8ff2410a4598 | |
| parent | db3a99b9921f27fe71ca8c0f218ee810e0e7fb69 (diff) | |
target: Fix queue full status NULL pointer for SCF_TRANSPORT_TASK_SENSE
During temporary resource starvation at lower transport layer, command
is placed on queue full retry path, which expose this problem. The TCM
queue full handling of SCF_TRANSPORT_TASK_SENSE currently sends the same
cmd twice to lower layer. The 1st time led to cmd normal free path.
The 2nd time cause Null pointer access.
This regression bug was originally introduced v3.1-rc code in the
following commit:
commit e057f53308a5f071556ee80586b99ee755bf07f5
Author: Christoph Hellwig <[email protected]>
Date: Mon Oct 17 13:56:41 2011 -0400
target: remove the transport_qf_callback se_cmd callback
Signed-off-by: Quinn Tran <[email protected]>
Signed-off-by: Saurav Kashyap <[email protected]>
Cc: <[email protected]> # v3.1+
Signed-off-by: Nicholas Bellinger <[email protected]>
| -rw-r--r-- | drivers/target/target_core_transport.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index 115632ee3ec8..9700ea125268 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1871,8 +1871,7 @@ static void transport_complete_qf(struct se_cmd *cmd) if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) { trace_target_cmd_complete(cmd); ret = cmd->se_tfo->queue_status(cmd); - if (ret) - goto out; + goto out; } switch (cmd->data_direction) { |