From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 18 Mar 2016 21:27:52 +0000 (-0700)
Subject: 3.14-stable patches
X-Git-Tag: v4.5.1~45
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a45744ea2537d0db73882d0321265755cdb99ec4;p=thirdparty%2Fkernel%2Fstable-queue.git

3.14-stable patches

added patches:
	target-drop-incorrect-abort_task-put-for-completed-commands.patch
---

diff --git a/queue-3.14/series b/queue-3.14/series
new file mode 100644
index 00000000000..3943d708ce6
--- /dev/null
+++ b/queue-3.14/series
@@ -0,0 +1 @@
+target-drop-incorrect-abort_task-put-for-completed-commands.patch
diff --git a/queue-3.14/target-drop-incorrect-abort_task-put-for-completed-commands.patch b/queue-3.14/target-drop-incorrect-abort_task-put-for-completed-commands.patch
new file mode 100644
index 00000000000..3509e3c9b66
--- /dev/null
+++ b/queue-3.14/target-drop-incorrect-abort_task-put-for-completed-commands.patch
@@ -0,0 +1,47 @@
+From 7f54ab5ff52fb0b91569bc69c4a6bc5cac1b768d Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Sat, 5 Mar 2016 20:00:12 -0800
+Subject: target: Drop incorrect ABORT_TASK put for completed commands
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 7f54ab5ff52fb0b91569bc69c4a6bc5cac1b768d upstream.
+
+This patch fixes a recent ABORT_TASK regression associated
+with commit febe562c, where a left-over target_put_sess_cmd()
+would still be called when __target_check_io_state() detected
+a command has already been completed, and explicit ABORT must
+be avoided.
+
+Note commit febe562c dropped the local kref_get_unless_zero()
+check in core_tmr_abort_task(), but did not drop this extra
+corresponding target_put_sess_cmd() in the failure path.
+
+So go ahead and drop this now bogus target_put_sess_cmd(),
+and avoid this potential use-after-free.
+
+Reported-by: Dan Lane <dracodan@gmail.com>
+Cc: Quinn Tran <quinn.tran@qlogic.com>
+Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
+Cc: Sagi Grimberg <sagig@mellanox.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Andy Grover <agrover@redhat.com>
+Cc: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_tmr.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -181,7 +181,6 @@ void core_tmr_abort_task(
+ 
+ 		if (!__target_check_io_state(se_cmd, se_sess, 0)) {
+ 			spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+-			target_put_sess_cmd(se_sess, se_cmd);
+ 			goto out;
+ 		}
+