From: Mike Christie Date: Sun, 1 Nov 2020 18:59:28 +0000 (-0600) Subject: scsi: target: Fix cmd_count ref leak X-Git-Tag: v5.11-rc1~108^2~224 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=02dd4914b0bcb8fd8f8cad9817f5715a17466261;p=thirdparty%2Flinux.git scsi: target: Fix cmd_count ref leak percpu_ref_init sets the refcount to 1 and percpu_ref_kill drops it. Drivers like iSCSI and loop do not call target_sess_cmd_list_set_waiting during session shutdown, though, so they have been calling percpu_ref_exit with a refcount still taken and leaking the cmd_counts memory. Link: https://lore.kernel.org/r/1604257174-4524-3-git-send-email-michael.christie@oracle.com Reviewed-by: Himanshu Madhani Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen --- diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index 693ed3fe43881..46fc2ffc42b40 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -238,6 +238,14 @@ EXPORT_SYMBOL(transport_init_session); void transport_uninit_session(struct se_session *se_sess) { + /* + * Drivers like iscsi and loop do not call + * target_sess_cmd_list_set_waiting during session shutdown so we + * have to drop the ref taken at init time here. + */ + if (!se_sess->sess_tearing_down) + percpu_ref_put(&se_sess->cmd_count); + percpu_ref_exit(&se_sess->cmd_count); }