This is a note to let you know that I've just added the patch titled
iscsi-target: Fix ABORT_TASK + connection reset iscsi_queue_req memory leak
to the 3.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
iscsi-target-fix-abort_task-connection-reset-iscsi_queue_req-memory-leak.patch
and it can be found in the queue-3.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From bbc050488525e1ab1194c27355f63c66814385b8 Mon Sep 17 00:00:00 2001
From: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
Date: Tue, 10 Jun 2014 04:03:54 +0000
Subject: iscsi-target: Fix ABORT_TASK + connection reset iscsi_queue_req memory leak
From: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
commit bbc050488525e1ab1194c27355f63c66814385b8 upstream.
This patch fixes a iscsi_queue_req memory leak when ABORT_TASK response
has been queued by TFO->queue_tm_rsp() -> lio_queue_tm_rsp() after a
long standing I/O completes, but the connection has already reset and
waiting for cleanup to complete in iscsit_release_commands_from_conn()
-> transport_generic_free_cmd() -> transport_wait_for_tasks() code.
It moves iscsit_free_queue_reqs_for_conn() after the per-connection command
list has been released, so that the associated se_cmd tag can be completed +
released by target-core before freeing any remaining iscsi_queue_req memory
for the connection generated by lio_queue_tm_rsp().
Cc: Thomas Glanzmann <thomas@xxxxxxxxxxxx>
Cc: Charalampos Pournaris <charpour@xxxxxxxxx>
Signed-off-by: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/target/iscsi/iscsi_target.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4234,8 +4234,6 @@ int iscsit_close_connection(
if (conn->conn_transport->iscsit_wait_conn)
conn->conn_transport->iscsit_wait_conn(conn);
- iscsit_free_queue_reqs_for_conn(conn);
-
/*
* During Connection recovery drop unacknowledged out of order
* commands for this connection, and prepare the other commands
@@ -4252,6 +4250,7 @@ int iscsit_close_connection(
iscsit_clear_ooo_cmdsns_for_conn(conn);
iscsit_release_commands_from_conn(conn);
}
+ iscsit_free_queue_reqs_for_conn(conn);
/*
* Handle decrementing session or connection usage count if
Patches currently in stable-queue which might be from nab@xxxxxxxxxxxxxxx are
queue-3.15/target-report-correct-response-length-for-some-commands.patch
queue-3.15/target-iser-fix-a-wrong-dereference-in-case-discovery-session-is-over-iser.patch
queue-3.15/target-iser-fix-hangs-in-connection-teardown.patch
queue-3.15/target-iscsi-fix-sendtargets-response-pdu-for-iser-transport.patch
queue-3.15/target-iser-bail-from-accept_np-if-np_thread-is-trying-to-close.patch
queue-3.15/target-use-complete_all-for-se_cmd-t_transport_stop_comp.patch
queue-3.15/libiscsi-iser-adjust-data_length-to-include-protection-information.patch
queue-3.15/target-set-cmd_t_active-bit-for-task-management-requests.patch
queue-3.15/target-iser-wait-for-proper-cleanup-before-unloading.patch
queue-3.15/target-sbc-loopback-adjust-command-data-length-in-case-pi-exists-on-the-wire.patch
queue-3.15/target-iser-gracefully-reject-t10-pi-enabled-connect-request-if-not-supported.patch
queue-3.15/scsi_cmnd-introduce-scsi_transfer_length-helper.patch
queue-3.15/target-iser-improve-cm-events-handling.patch
queue-3.15/iscsi-target-fix-abort_task-connection-reset-iscsi_queue_req-memory-leak.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html