> On Oct 29, 2020, at 1:49 AM, Mike Christie <michael.christie@xxxxxxxxxx> wrote:
>
> percpu_ref_init sets the refcount to 1 and percpu_ref_kill drops it.
> Drivers like iscsi and loop do not call target_sess_cmd_list_set_waiting
> during session shutdown though, so they have been calling
> percpu_ref_exit
> with a refcount still taken and leaking the cmd_counts memory.
>
> Signed-off-by: Mike Christie <michael.christie@xxxxxxxxxx>
> ---
> drivers/target/target_core_transport.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index ff26ab0..d47619a 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -238,6 +238,14 @@ int transport_init_session(struct se_session *se_sess)
>
> void transport_uninit_session(struct se_session *se_sess)
> {
> + /*
> + * Drivers like iscsi and loop do not call
> + * target_sess_cmd_list_set_waiting during session shutdown so we
> + * have to drop the ref taken at init time here.
> + */
> + if (!se_sess->sess_tearing_down)
> + percpu_ref_put(&se_sess->cmd_count);
> +
> percpu_ref_exit(&se_sess->cmd_count);
> }
>
> --
> 1.8.3.1
>
Looks Good.
Reviewed-by: Himanshu Madhani <himanshu.madhani@xxxxxxxxxx>
--
Himanshu Madhani Oracle Linux Engineering
