[PATCH 15/18] scsi: target: iscsit: Fix TAS handling during conn cleanup

[Mike Christie <michael.christie@xxxxxxxxxx>]

This fixes a bug added in:

commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop
race")

If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd to do the
last put on the cmd and free it, because the connection is down and we
will not up sending the response and doing the put from the normal IO
path. This patch adds a check for CMD_T_TAS in
iscsit_release_commands_from_conn so we now detect this case and run
iscsit_free_cmd.

Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race")
Signed-off-by: Mike Christie <michael.christie@xxxxxxxxxx>
---
 drivers/target/iscsi/iscsi_target.c | 52 ++++++++++++++++-------------
 1 file changed, 29 insertions(+), 23 deletions(-)

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index cd9ef668a054..a64b984b9dca 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4220,30 +4220,36 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn)
 	list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
 		struct se_cmd *se_cmd = &cmd->se_cmd;
 
-		if (se_cmd->se_tfo != NULL) {
-			spin_lock_irq(&se_cmd->t_state_lock);
-			if (se_cmd->transport_state & CMD_T_ABORTED) {
-				/*
-				 * LIO's abort path owns the cleanup for this,
-				 * so put it back on the list and let
-				 * aborted_task handle it.
-				 */
-				list_move_tail(&cmd->i_conn_node,
-					       &conn->conn_cmd_list);
-			} else if (conn->sess->sess_ops->RDMAExtensions &&
-				   (se_cmd->transport_state & CMD_T_COMPLETE) &&
-				   !iscsit_cmd_failed(cmd)) {
-				/*
-				 * isert is still handling these cmds so wait in
-				 * target_wait_for_cmds.
-				 */
+		if (!se_cmd->se_tfo)
+			continue;
+
+		spin_lock_irq(&se_cmd->t_state_lock);
+		if (se_cmd->transport_state & CMD_T_ABORTED) {
+			/*
+			 * If TAS is set, we complete it similar to a normal
+			 * cmd and will wait on and free it below. We don't
+			 * set any of the STOP bits, so we work like other
+			 * drivers and wait on the cmd's free_compl.
+			 *
+			 * If TAS is not set, then LIO's abort patch owns the
+			 * cleanup, so we put it back on the list and let
+			 * the aborted_task path handle it.
+			 */
+			if (!(se_cmd->transport_state & CMD_T_TAS))
 				list_move_tail(&cmd->i_conn_node,
 					       &conn->conn_cmd_list);
-			} else {
-				se_cmd->transport_state |= CMD_T_FABRIC_STOP;
-			}
-			spin_unlock_irq(&se_cmd->t_state_lock);
+		} else if (conn->sess->sess_ops->RDMAExtensions &&
+			   (se_cmd->transport_state & CMD_T_COMPLETE) &&
+			   !iscsit_cmd_failed(cmd)) {
+			/*
+			 * isert is still handling these cmds so wait in
+			 * target_wait_for_cmds.
+			 */
+			list_move_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
+		} else {
+			se_cmd->transport_state |= CMD_T_FABRIC_STOP;
 		}
+		spin_unlock_irq(&se_cmd->t_state_lock);
 	}
 	spin_unlock_bh(&conn->cmd_lock);
 
@@ -4256,7 +4262,7 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn)
 		 * 1. we have not got acks for.
 		 * 2. are (or will be when the backend completes them) stuck
 		 * on the response/immediate queue (failed cmds, TMRs, iscsi
-		 * reqs).
+		 * reqs, aborted cmds with TAS).
 		 * 3. completed ok on the backend, but hit the CMD_T_FABRIC_STOP
 		 * or CMD_T_STOP checks.
 		 */
@@ -4265,7 +4271,7 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn)
 
 	/*
 	 * We need to wait:
-	 * 1. for commands that are being cleaned up via the aborted_task path.
+	 * 1. for commands that are being aborted with no TAS.
 	 * 2. for isert we need to wait for iscsit_queue_status calls
 	 * that posted a response after the ib_drain_qp call returned but
 	 * have not yet called isert_send_done.
-- 
2.31.1