iscsi-target: Fix ISCSI_OP_SCSI_TMFUNC handling for iser

commit 186a9647019587b3784694894c4d136fd00cfd7b upstream.

This patch adds target_get_sess_cmd reference counting for
iscsit_handle_task_mgt_cmd(), and adds a target_put_sess_cmd()
for the failure case.

It also fixes a bug where ISCSI_OP_SCSI_TMFUNC type commands
where leaking iscsi_cmd->i_conn_node and eventually triggering
an OOPs during struct isert_conn shutdown.

Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 8 insertions, 8 deletions

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 6b20a9d09cbb..bfc21798bd5e 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -1202,14 +1202,12 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
 {
         struct iscsi_cmd *cmd = &isert_cmd->iscsi_cmd;
         struct isert_conn *isert_conn = isert_cmd->conn;
-        struct iscsi_conn *conn;
+        struct iscsi_conn *conn = isert_conn->conn;
 
         pr_debug("Entering isert_put_cmd: %p\n", isert_cmd);
 
         switch (cmd->iscsi_opcode) {
         case ISCSI_OP_SCSI_CMD:
-                conn = isert_conn->conn;
-
                 spin_lock_bh(&conn->cmd_lock);
                 if (!list_empty(&cmd->i_conn_node))
                         list_del(&cmd->i_conn_node);
@@ -1219,16 +1217,18 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
                         iscsit_stop_dataout_timer(cmd);
 
                 isert_unmap_cmd(isert_cmd, isert_conn);
-                /*
-                 * Fall-through
-                 */
+                transport_generic_free_cmd(&cmd->se_cmd, 0);
+                break;
         case ISCSI_OP_SCSI_TMFUNC:
+                spin_lock_bh(&conn->cmd_lock);
+                if (!list_empty(&cmd->i_conn_node))
+                        list_del(&cmd->i_conn_node);
+                spin_unlock_bh(&conn->cmd_lock);
+
                 transport_generic_free_cmd(&cmd->se_cmd, 0);
                 break;
         case ISCSI_OP_REJECT:
         case ISCSI_OP_NOOP_OUT:
-                conn = isert_conn->conn;
-
                 spin_lock_bh(&conn->cmd_lock);
                 if (!list_empty(&cmd->i_conn_node))
                         list_del(&cmd->i_conn_node);