From: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx> This patch makes srpt_release_channel_work() return instead of BUG_ON when a ch->sess is not active, so srpt_release_channel_work() may be called from srpt_compl_thread() context when a SRP_LOGIN_REQ has failed within srpt_cm_req_recv(), and is being released directly via srpt_destroy_ch_ib(). This bug was introduced with 'ib_srpt: Fix Last WQE handling' Cc: Bart Van Assche <bvanassche@xxxxxxx> Cc: Roland Dreier <roland@xxxxxxxxxxxxxxx> Signed-off-by: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx> --- drivers/infiniband/ulp/srpt/ib_srpt.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index ebe39d8..2d26c21 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -2340,7 +2340,13 @@ static void srpt_release_channel_work(struct work_struct *w) BUG_ON(!sdev); se_sess = ch->sess; - BUG_ON(!se_sess); + /* + * May be NULL when shutting down during srpt_cm_req_recv() login + * exception where the caller is expected to free *ch in the + * failure path. + */ + if (!se_sess) + return; target_splice_sess_cmd_list(se_sess); target_wait_for_sess_cmds(se_sess, 0); -- 1.7.2.5 -- To unsubscribe from this list: send the line "unsubscribe target-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
