From: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx> This patch moves the struct target_core_fabric_ops->fabric_drop_nodeacl() callback and subsequent fabric dependent release of struct se_node_acl memory to the configfs callback target_fabric_nacl_base_item_ops->release() called from within fs/configfs/item.c:config_item_cleanup() context. This patch resolves the following SLUB 'Poison overwritten' warning when calling tfc->fabric_drop_node_acl() directly after config_item_put() for the fabric dependent data structure containing struct se_node_acl->acl_group: [ 2500.148656] ============================================================================= [ 2500.148656] BUG kmalloc-2048: Poison overwritten [ 2500.148656] ----------------------------------------------------------------------------- [ 2500.148656] [ 2500.148656] INFO: 0xffff880001e6a6f4-0xffff880001e6a6f4. First byte 0x6a instead of 0x6b [ 2500.148656] INFO: Allocated in 0xffffffffa02b9e55 age=265456 cpu=0 pid=8233 [ 2500.148656] INFO: Freed in 0xffffffffa02c8f9b age=251652 cpu=0 pid=8244 [ 2500.148656] INFO: Slab 0xffffea000006a6c0 objects=15 used=5 fp=0xffff880001e6a120 flags=0x1000000000040c1 [ 2500.148656] INFO: Object 0xffff880001e6a120 @offset=8480 fp=0xffff880001e698d8 Cc: Joel Becker <jlbec@xxxxxxxxxxxx> Cc: Christoph Hellwig <hch@xxxxxx> Signed-off-by: Nicholas A. Bellinger <nab@xxxxxxxxxxxxxxx> --- drivers/target/target_core_fabric_configfs.c | 19 ++++++++++++++----- 1 files changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c index 225284d..dfa3267 100644 --- a/drivers/target/target_core_fabric_configfs.c +++ b/drivers/target/target_core_fabric_configfs.c @@ -345,7 +345,18 @@ static void target_fabric_drop_mappedlun( core_dev_free_initiator_node_lun_acl(se_tpg, lacl); } +static void target_fabric_nacl_base_release(struct config_item *item) +{ + struct se_node_acl *se_nacl = container_of(to_config_group(item), + struct se_node_acl, acl_group); + struct se_portal_group *se_tpg = se_nacl->se_tpg; + struct target_fabric_configfs *tf = se_tpg->se_tpg_wwn->wwn_tf; + + tf->tf_ops.fabric_drop_nodeacl(se_nacl); +} + static struct configfs_item_operations target_fabric_nacl_base_item_ops = { + .release = target_fabric_nacl_base_release, .show_attribute = target_fabric_nacl_base_attr_show, .store_attribute = target_fabric_nacl_base_attr_store, }; @@ -404,9 +415,6 @@ static void target_fabric_drop_nodeacl( struct config_group *group, struct config_item *item) { - struct se_portal_group *se_tpg = container_of(group, - struct se_portal_group, tpg_acl_group); - struct target_fabric_configfs *tf = se_tpg->se_tpg_wwn->wwn_tf; struct se_node_acl *se_nacl = container_of(to_config_group(item), struct se_node_acl, acl_group); struct config_item *df_item; @@ -419,9 +427,10 @@ static void target_fabric_drop_nodeacl( nacl_cg->default_groups[i] = NULL; config_item_put(df_item); } - + /* + * struct se_node_acl free is done in target_fabric_nacl_base_release() + */ config_item_put(item); - tf->tf_ops.fabric_drop_nodeacl(se_nacl); } static struct configfs_group_operations target_fabric_nacl_group_ops = { -- 1.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html