diff options
| author | Mike Christie <michael.christie@oracle.com> | 2020-11-01 12:59:28 -0600 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2020-11-04 22:39:37 -0500 |
| commit | 02dd4914b0bcb8fd8f8cad9817f5715a17466261 (patch) | |
| tree | 21fdafac85fc120b591f0cfb7aa3518bdf19cd05 /drivers/target/target_core_transport.c | |
| parent | a2b5d6f975a499bd50919a409c6a7c4cbf9d8a58 (diff) | |
| download | lwn-02dd4914b0bcb8fd8f8cad9817f5715a17466261.tar.gz lwn-02dd4914b0bcb8fd8f8cad9817f5715a17466261.zip | |
scsi: target: Fix cmd_count ref leak
percpu_ref_init sets the refcount to 1 and percpu_ref_kill drops it.
Drivers like iSCSI and loop do not call target_sess_cmd_list_set_waiting
during session shutdown, though, so they have been calling percpu_ref_exit
with a refcount still taken and leaking the cmd_counts memory.
Link: https://lore.kernel.org/r/1604257174-4524-3-git-send-email-michael.christie@oracle.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/target/target_core_transport.c')
| -rw-r--r-- | drivers/target/target_core_transport.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index 693ed3fe4388..46fc2ffc42b4 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -238,6 +238,14 @@ EXPORT_SYMBOL(transport_init_session); void transport_uninit_session(struct se_session *se_sess) { + /* + * Drivers like iscsi and loop do not call + * target_sess_cmd_list_set_waiting during session shutdown so we + * have to drop the ref taken at init time here. + */ + if (!se_sess->sess_tearing_down) + percpu_ref_put(&se_sess->cmd_count); + percpu_ref_exit(&se_sess->cmd_count); } |