target: Make TFO->check_stop_free return free status

This patch converts target_core_fabric_ops->check_stop_free() usage in
transport_cmd_check_stop() and associated fabric module usage to
return '1' when the passed se_cmd has been released directly within
->check_stop_free(), or return '0' when the passed se_cmd has not
been released.

This addresses an issue where transport_cmd_finish_abort() ->
transport_cmd_check_stop_to_fabric() was leaking descriptors during
LUN_RESET for modules using ->check_stop_free(), but not directly
releasing se_cmd in all cases.

Cc: stable@kernel.org
Signed-off-by: Nicholas Bellinger <nab@risingtidesystems.com>

diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 3c9c318f66ed4d2f3890e339d0938bb60ca0a2e9..3df1c9b8ae6b7e07118575ebbf24a59124644b01 100644 (file)
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -205,7 +205,7 @@ static int tcm_loop_new_cmd_map(struct se_cmd *se_cmd)
 /*
  * Called from struct target_core_fabric_ops->check_stop_free()
  */
-static void tcm_loop_check_stop_free(struct se_cmd *se_cmd)
+static int tcm_loop_check_stop_free(struct se_cmd *se_cmd)
 {
        /*
         * Do not release struct se_cmd's containing a valid TMR
@@ -213,12 +213,13 @@ static void tcm_loop_check_stop_free(struct se_cmd *se_cmd)
         * with transport_generic_free_cmd().
         */
        if (se_cmd->se_tmr_req)
-               return;
+               return 0;
        /*
         * Release the struct se_cmd, which will make a callback to release
         * struct tcm_loop_cmd * in tcm_loop_deallocate_core_cmd()
         */
        transport_generic_free_cmd(se_cmd, 0);
+       return 1;
 }
 
 static void tcm_loop_release_cmd(struct se_cmd *se_cmd)

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 5dee44639f8ffc4f29a7e074e3b9d6be3ad3179e..bf8867f44021f7cffbccc0aade32db0e5a88bde9 100644 (file)
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -514,13 +514,16 @@ static int transport_cmd_check_stop(
                         * Some fabric modules like tcm_loop can release
                         * their internally allocated I/O reference now and
                         * struct se_cmd now.
+                        *
+                        * Fabric modules are expected to return '1' here if the
+                        * se_cmd being passed is released at this point,
+                        * or zero if not being released.
                         */
                        if (cmd->se_tfo->check_stop_free != NULL) {
                                spin_unlock_irqrestore(
                                        &cmd->t_state_lock, flags);
 
-                               cmd->se_tfo->check_stop_free(cmd);
-                               return 1;
+                               return cmd->se_tfo->check_stop_free(cmd);
                        }
                }
                spin_unlock_irqrestore(&cmd->t_state_lock, flags);

diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index 3749d8b4b4233115a3e1fb1bede71e15104f8a01..e05c55100ec679e1633b2ecf7fc5b988288481c5 100644 (file)
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -156,7 +156,7 @@ int ft_lport_notify(struct notifier_block *, unsigned long, void *);
 /*
  * IO methods.
  */
-void ft_check_stop_free(struct se_cmd *);
+int ft_check_stop_free(struct se_cmd *);
 void ft_release_cmd(struct se_cmd *);
 int ft_queue_status(struct se_cmd *);
 int ft_queue_data_in(struct se_cmd *);

diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 6195026cc7b02bb908cecd6ed32f9527a3b34399..4fac37c4c615263abbfa60594cfcfc3f1917dbc7 100644 (file)
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -112,9 +112,10 @@ void ft_release_cmd(struct se_cmd *se_cmd)
        ft_free_cmd(cmd);
 }
 
-void ft_check_stop_free(struct se_cmd *se_cmd)
+int ft_check_stop_free(struct se_cmd *se_cmd)
 {
        transport_generic_free_cmd(se_cmd, 0);
+       return 1;
 }
 
 /*

diff --git a/include/target/target_core_fabric_ops.h b/include/target/target_core_fabric_ops.h
index 126c675f4f14e5b41afd30694615b84d5eedbcbc..04c591da084447513d78adeda3a183ba529f842c 100644 (file)
--- a/include/target/target_core_fabric_ops.h
+++ b/include/target/target_core_fabric_ops.h
@@ -46,9 +46,12 @@ struct target_core_fabric_ops {
        int (*new_cmd_map)(struct se_cmd *);
        /*
         * Optional to release struct se_cmd and fabric dependent allocated
-        * I/O descriptor in transport_cmd_check_stop()
+        * I/O descriptor in transport_cmd_check_stop().
+        *
+        * Returning 1 will signal a descriptor has been released.
+        * Returning 0 will signal a descriptor has not been released.
         */
-       void (*check_stop_free)(struct se_cmd *);
+       int (*check_stop_free)(struct se_cmd *);
        void (*release_cmd)(struct se_cmd *);
        /*
         * Called with spin_lock_bh(struct se_portal_group->session_lock held.