diff mbox series

[2/8] target: fix cmd_count ref leak

Message ID 1603954171-11621-3-git-send-email-michael.christie@oracle.com (mailing list archive)
State Changes Requested
Headers show
Series target: fix up locking in IO paths | expand

Commit Message

Mike Christie Oct. 29, 2020, 6:49 a.m. UTC 
percpu_ref_init sets the refcount to 1 and percpu_ref_kill drops it.
Drivers like iscsi and loop do not call target_sess_cmd_list_set_waiting
during session shutdown though, so they have been calling
percpu_ref_exit
with a refcount still taken and leaking the cmd_counts memory.

Signed-off-by: Mike Christie <michael.christie@oracle.com>
---
 drivers/target/target_core_transport.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Himanshu Madhani Oct. 29, 2020, 8:22 p.m. UTC | #1 
> On Oct 29, 2020, at 1:49 AM, Mike Christie <michael.christie@oracle.com> wrote:
> 
> percpu_ref_init sets the refcount to 1 and percpu_ref_kill drops it.
> Drivers like iscsi and loop do not call target_sess_cmd_list_set_waiting
> during session shutdown though, so they have been calling
> percpu_ref_exit
> with a refcount still taken and leaking the cmd_counts memory.
> 
> Signed-off-by: Mike Christie <michael.christie@oracle.com>
> ---
> drivers/target/target_core_transport.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index ff26ab0..d47619a 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -238,6 +238,14 @@ int transport_init_session(struct se_session *se_sess)
> 
> void transport_uninit_session(struct se_session *se_sess)
> {
> +	/*
> +	 * Drivers like iscsi and loop do not call
> +	 * target_sess_cmd_list_set_waiting during session shutdown so we
> +	 * have to drop the ref taken at init time here.
> +	 */
> +	if (!se_sess->sess_tearing_down)
> +		percpu_ref_put(&se_sess->cmd_count);
> +
> 	percpu_ref_exit(&se_sess->cmd_count);
> }
> 
> -- 
> 1.8.3.1
> 

Looks Good. 

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

--
Himanshu Madhani	 Oracle Linux Engineering
diff mbox series

Patch

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index ff26ab0..d47619a 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -238,6 +238,14 @@  int transport_init_session(struct se_session *se_sess)
 
 void transport_uninit_session(struct se_session *se_sess)
 {
+	/*
+	 * Drivers like iscsi and loop do not call
+	 * target_sess_cmd_list_set_waiting during session shutdown so we
+	 * have to drop the ref taken at init time here.
+	 */
+	if (!se_sess->sess_tearing_down)
+		percpu_ref_put(&se_sess->cmd_count);
+
 	percpu_ref_exit(&se_sess->cmd_count);
 }