target: Make TFO->check_stop_free return free status

This patch converts target_core_fabric_ops->check_stop_free() usage in
transport_cmd_check_stop() and associated fabric module usage to
return '1' when the passed se_cmd has been released directly within
->check_stop_free(), or return '0' when the passed se_cmd has not
been released.

This addresses an issue where transport_cmd_finish_abort() ->
transport_cmd_check_stop_to_fabric() was leaking descriptors during
LUN_RESET for modules using ->check_stop_free(), but not directly
releasing se_cmd in all cases.

Cc: stable@kernel.org
Signed-off-by: Nicholas Bellinger <nab@risingtidesystems.com>

4 files changed, 11 insertions, 6 deletions

diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 3c9c318f66ed..3df1c9b8ae6b 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -205,7 +205,7 @@ static int tcm_loop_new_cmd_map(struct se_cmd *se_cmd)
 /*
  * Called from struct target_core_fabric_ops->check_stop_free()
  */
-static void tcm_loop_check_stop_free(struct se_cmd *se_cmd)
+static int tcm_loop_check_stop_free(struct se_cmd *se_cmd)
 {
         /*
          * Do not release struct se_cmd's containing a valid TMR
@@ -213,12 +213,13 @@ static void tcm_loop_check_stop_free(struct se_cmd *se_cmd)
          * with transport_generic_free_cmd().
          */
         if (se_cmd->se_tmr_req)
-                return;
+                return 0;
         /*
          * Release the struct se_cmd, which will make a callback to release
          * struct tcm_loop_cmd * in tcm_loop_deallocate_core_cmd()
          */
         transport_generic_free_cmd(se_cmd, 0);
+        return 1;
 }
 
 static void tcm_loop_release_cmd(struct se_cmd *se_cmd)
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 5dee44639f8f..bf8867f44021 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -514,13 +514,16 @@ static int transport_cmd_check_stop(
                          * Some fabric modules like tcm_loop can release
                          * their internally allocated I/O reference now and
                          * struct se_cmd now.
+                         *
+                         * Fabric modules are expected to return '1' here if the
+                         * se_cmd being passed is released at this point,
+                         * or zero if not being released.
                          */
                         if (cmd->se_tfo->check_stop_free != NULL) {
                                 spin_unlock_irqrestore(
                                         &cmd->t_state_lock, flags);
 
-                                cmd->se_tfo->check_stop_free(cmd);
-                                return 1;
+                                return cmd->se_tfo->check_stop_free(cmd);
                         }
                 }
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index 3749d8b4b423..e05c55100ec6 100644
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -156,7 +156,7 @@ int ft_lport_notify(struct notifier_block *, unsigned long, void *);
 /*
  * IO methods.
  */
-void ft_check_stop_free(struct se_cmd *);
+int ft_check_stop_free(struct se_cmd *);
 void ft_release_cmd(struct se_cmd *);
 int ft_queue_status(struct se_cmd *);
 int ft_queue_data_in(struct se_cmd *);
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 6195026cc7b0..4fac37c4c615 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -112,9 +112,10 @@ void ft_release_cmd(struct se_cmd *se_cmd)
         ft_free_cmd(cmd);
 }
 
-void ft_check_stop_free(struct se_cmd *se_cmd)
+int ft_check_stop_free(struct se_cmd *se_cmd)
 {
         transport_generic_free_cmd(se_cmd, 0);
+        return 1;
 }
 
 /*