On Sun, Nov 27, 2011 at 2:06 AM, Nicholas A. Bellinger <nab@xxxxxxxxxxxxxxx> wrote: > diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c > index ebe39d8..2d26c21 100644 > --- a/drivers/infiniband/ulp/srpt/ib_srpt.c > +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c > @@ -2340,7 +2340,13 @@ static void srpt_release_channel_work(struct work_struct *w) > BUG_ON(!sdev); > > se_sess = ch->sess; > - BUG_ON(!se_sess); > + /* > + * May be NULL when shutting down during srpt_cm_req_recv() login > + * exception where the caller is expected to free *ch in the > + * failure path. > + */ > + if (!se_sess) > + return; > > target_splice_sess_cmd_list(se_sess); > target_wait_for_sess_cmds(se_sess, 0); This doesn't look like a proper fix to me. If session allocation or registration failed, srpt_cm_req_recv() can already have invoked kfree(ch) before srpt_release_channel_work() gets invoked. Bart. -- To unsubscribe from this list: send the line "unsubscribe target-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
