On Thu, Nov 16, 2017 at 06:05:07AM +0000, Nicholas A. Bellinger wrote: > From: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx> > > commit 6bcbb3174caa5f1ccc894f8ae077631659d5a629 upstream. > > This patch drops two incorrect usages of tcm_qla2xxx_free_cmd() > during TMR ABORT within tcm_qla2xxx_handle_data_work() and > tcm_qla2xxx_aborted_task(), which where attempting to dispatch > into workqueue context to do tcm_qla2xxx_complete_free() and > subsequently invoke transport_generic_free_cmd(). > > This is incorrect because during TMR ABORT target-core will > drop the outstanding se_cmd->cmd_kref references once it has > quiesced the se_cmd via transport_wait_for_tasks(), and in > the case of qla2xxx it should not attempt to do it's own > transport_generic_free_cmd() once the abort has occured. > > As reported by Pascal, this was originally manifesting as a > BUG_ON(cmd->cmd_in_wq) in qlt_free_cmd() during TMR ABORT, > with a LIO backend that had sufficently high enough WRITE > latency to trigger a host side TMR ABORT_TASK. > > (v2: Drop the qla_tgt_cmd->write_pending_abort_comp changes, > as they will be addressed in a seperate series) > > Reported-by: Pascal de Bruijn <p.debruijn@xxxxxxxxxxx> > Tested-by: Pascal de Bruijn <p.debruijn@xxxxxxxxxxx> > Cc: Pascal de Bruijn <p.debruijn@xxxxxxxxxxx> > Reported-by: Lukasz Engel <lukasz.engel@xxxxxxxxx> > Cc: Lukasz Engel <lukasz.engel@xxxxxxxxx> > Acked-by: Himanshu Madhani <himanshu.madhani@xxxxxxxxxx> > Cc: Quinn Tran <quinn.tran@xxxxxxxxxx> > Cc: <stable@xxxxxxxxxxxxxxx> # 3.10+ > Signed-off-by: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx> > --- > drivers/scsi/qla2xxx/tcm_qla2xxx.c | 33 --------------------------------- > 1 file changed, 33 deletions(-) Thanks for this, but how about a backport for it for 4.4 and 3.18? thanks, greg k-h