On Thu, Nov 3, 2011 at 8:52 PM, Nicholas A. Bellinger <nab@xxxxxxxxxxxxxxx> wrote: > @@ -2365,8 +2384,14 @@ static void srpt_release_channel_work(struct work_struct *w) > sdev = ch->sport->sdev; > BUG_ON(!sdev); > > - transport_deregister_session_configfs(ch->sess); > - transport_deregister_session(ch->sess); > + se_sess = ch->sess; > + BUG_ON(!se_sess); > + > + target_splice_sess_cmd_list(se_sess); > + target_wait_for_sess_cmds(se_sess, 0); > + > + transport_deregister_session_configfs(se_sess); > + transport_deregister_session(se_sess); > ch->sess = NULL; > > srpt_destroy_ch_ib(ch); This leaves the possibility open that ch->sess is used by srpt_handle_new_iu() while transport_deregister_session() is in progress. That's a race condition. Bart. -- To unsubscribe from this list: send the line "unsubscribe target-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
