diff mbox

[1/1] tcmu: fix cmd user after free

Message ID 1516048679-8704-1-git-send-email-mchristi@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Mike Christie Jan. 15, 2018, 8:37 p.m. UTC
If we are failing the command due to a qfull timeout we are
also freeing the tcmu command, so we cannot access it later
to get the se_cmd.

Note: The clearing of cmd->se_cmd is not needed. We do not check
it later for something like determining if the command was failed
due to a timeout. As a result I am dropping it.

Signed-off-by: Mike Christie <mchristi@redhat.com>
---
 drivers/target/target_core_user.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Nicholas A. Bellinger Jan. 18, 2018, 9:22 a.m. UTC | #1
On Mon, 2018-01-15 at 14:37 -0600, Mike Christie wrote:
> If we are failing the command due to a qfull timeout we are
> also freeing the tcmu command, so we cannot access it later
> to get the se_cmd.
> 
> Note: The clearing of cmd->se_cmd is not needed. We do not check
> it later for something like determining if the command was failed
> due to a timeout. As a result I am dropping it.
> 
> Signed-off-by: Mike Christie <mchristi@redhat.com>
> ---
>  drivers/target/target_core_user.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 

Applied.

--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 60c8a87..49b76ee 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1146,6 +1146,7 @@  static int tcmu_check_expired_cmd(int id, void *p, void *data)
 		return 0;
 
 	is_running = list_empty(&cmd->cmdr_queue_entry);
+	se_cmd = cmd->se_cmd;
 
 	if (is_running) {
 		/*
@@ -1171,8 +1172,6 @@  static int tcmu_check_expired_cmd(int id, void *p, void *data)
 	pr_debug("Timing out cmd %u on dev %s that is %s.\n",
 		 id, udev->name, is_running ? "inflight" : "queued");
 
-	se_cmd = cmd->se_cmd;
-	cmd->se_cmd = NULL;
 	target_complete_cmd(se_cmd, scsi_status);
 	return 0;
 }