qla2xxx: Fix incorrect tcm_qla2xxx_free_cmd use during TMR ABORT (v2)
authorNicholas Bellinger <nab@linux-iscsi.org>
Fri, 30 Jun 2017 07:08:13 +0000 (00:08 -0700)
committerNicholas Bellinger <nab@linux-iscsi.org>
Sun, 30 Jul 2017 23:48:43 +0000 (16:48 -0700)
commit6bcbb3174caa5f1ccc894f8ae077631659d5a629
tree230908352d46945e5d7096cb46cba8fcd83a20d4
parentd96adb9b076a12d30500347e2e667689062f44a0
qla2xxx: Fix incorrect tcm_qla2xxx_free_cmd use during TMR ABORT (v2)

This patch drops two incorrect usages of tcm_qla2xxx_free_cmd()
during TMR ABORT within tcm_qla2xxx_handle_data_work() and
tcm_qla2xxx_aborted_task(), which where attempting to dispatch
into workqueue context to do tcm_qla2xxx_complete_free() and
subsequently invoke transport_generic_free_cmd().

This is incorrect because during TMR ABORT target-core will
drop the outstanding se_cmd->cmd_kref references once it has
quiesced the se_cmd via transport_wait_for_tasks(), and in
the case of qla2xxx it should not attempt to do it's own
transport_generic_free_cmd() once the abort has occured.

As reported by Pascal, this was originally manifesting as a
BUG_ON(cmd->cmd_in_wq) in qlt_free_cmd() during TMR ABORT,
with a LIO backend that had sufficently high enough WRITE
latency to trigger a host side TMR ABORT_TASK.

(v2: Drop the qla_tgt_cmd->write_pending_abort_comp changes,
     as they will be addressed in a seperate series)

Reported-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
Tested-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
Cc: Pascal de Bruijn <p.debruijn@unilogic.nl>
Reported-by: Lukasz Engel <lukasz.engel@softax.pl>
Cc: Lukasz Engel <lukasz.engel@softax.pl>
Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Cc: Quinn Tran <quinn.tran@cavium.com>
Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
drivers/scsi/qla2xxx/tcm_qla2xxx.c