target: Fix possible NULL pointer with __transport_execute_tasks

This patch makes __transport_execute_tasks() use a local *se_dev
reference to prevent direct se_cmd->se_dev access after
transport_cmd_check_stop() -> transport_add_tasks_from_cmd()
has been called, as in the current implementation we can expect
__transport_execute_tasks() may be called from another context
that may have already completed the I/O.

Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index e4389d40c0576d7e86fab034429964dc963e8bbf..1cc7e920ab0b4497c1fc7539d012a078852fd41a 100644 (file)
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2076,6 +2076,7 @@ static inline int transport_execute_task_attr(struct se_cmd *cmd)
 static int transport_execute_tasks(struct se_cmd *cmd)
 {
        int add_tasks;
+       struct se_device *se_dev = cmd->se_dev;
 
        if (se_dev_check_online(cmd->se_dev) != 0) {
                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -2108,7 +2109,7 @@ static int transport_execute_tasks(struct se_cmd *cmd)
         * storage object.
         */
 execute_tasks:
-       __transport_execute_tasks(cmd->se_dev);
+       __transport_execute_tasks(se_dev);
        return 0;
 }