This fixes a bug added in: commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race") If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd to do the last put on the cmd and free it, because the connection is down and we will not up sending the response and doing the put from the normal IO path. This patch adds a check for CMD_T_TAS in iscsit_release_commands_from_conn so we now detect this case. Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race") Signed-off-by: Mike Christie <michael.christie@xxxxxxxxxx> --- drivers/target/iscsi/iscsi_target.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 83b007141229..2a011afa6dff 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -4222,7 +4222,8 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn) if (se_cmd->se_tfo != NULL) { spin_lock_irq(&se_cmd->t_state_lock); - if (se_cmd->transport_state & CMD_T_ABORTED) { + if (se_cmd->transport_state & CMD_T_ABORTED && + !(se_cmd->transport_state & CMD_T_TAS)) { /* * LIO's abort path owns the cleanup for this, * so put it back on the list and let -- 2.31.1