Patch "target: Fix early transport_generic_handle_tmr abort scenario" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

target: Fix early transport_generic_handle_tmr abort scenario

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
target-fix-early-transport_generic_handle_tmr-abort-scenario.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Nicholas Bellinger <[email protected]>
Date: Tue, 6 Dec 2016 22:45:46 -0800
Subject: target: Fix early transport_generic_handle_tmr abort scenario

From: Nicholas Bellinger <[email protected]>

commit c54eeffbe9338fa982dc853d816fda9202a13b5a upstream.

This patch fixes a bug where incoming task management requests can be explicitly aborted during an active LUN_RESET, but who's struct work_struct are canceled in-flight before execution.

This occurs when core_tmr_drain_tmr_list() invokes cancel_work_sync() for the incoming se_tmr_req->task_cmd->work, resulting in cmd->work for target_tmr_work() never getting invoked and the aborted TMR waiting indefinately within transport_wait_for_tasks().

To address this case, perform a CMD_T_ABORTED check early in transport_generic_handle_tmr(), and invoke the normal path via transport_cmd_check_stop_to_fabric() to complete any TMR kthreads blocked waiting for CMD_T_STOP in transport_wait_for_tasks().

Also, move the TRANSPORT_ISTATE_PROCESSING assignment earlier into transport_generic_handle_tmr() so the existing check in core_tmr_drain_tmr_list() avoids attempting abort the incoming se_tmr_req->task_cmd->work if it has already been queued into se_device->tmr_wq.

---
 drivers/target/target_core_transport.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

@@ -3086,7 +3086,6 @@ static void target_tmr_work(struct work_
 		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 		goto check_stop;
 	}
-	cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
 	cmd->se_tfo->queue_tm_rsp(cmd);

@@ -3099,11 +3098,25 @@ int transport_generic_handle_tmr(
 	struct se_cmd *cmd)
 {
 	unsigned long flags;
+	bool aborted = false;
 
 	spin_lock_irqsave(&cmd->t_state_lock, flags);
-	cmd->transport_state |= CMD_T_ACTIVE;
+	if (cmd->transport_state & CMD_T_ABORTED) {
+		aborted = true;
+	} else {
+		cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+		cmd->transport_state |= CMD_T_ACTIVE;
+	}
 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
+	if (aborted) {
+		pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d"
+			"ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function,
+			cmd->se_tmr_req->ref_task_tag, cmd->tag);
+		transport_cmd_check_stop_to_fabric(cmd);
+		return 0;
+	}
+
 	INIT_WORK(&cmd->work, target_tmr_work);
 	queue_work(cmd->se_dev->tmr_wq, &cmd->work);
 	return 0;

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/target-fix-compare_and_write-ref-leak-for-non-good-status.patch queue-4.9/target-fix-multi-session-dynamic-se_node_acl-double-free-oops.patch queue-4.9/target-use-correct-scsi-status-during-extended_copy-exception.patch queue-4.9/ibmvscsis-add-sgl-limit.patch queue-4.9/target-don-t-bug_on-during-nodeacl-dynamic-explicit-conversion.patch queue-4.9/target-fix-early-transport_generic_handle_tmr-abort-scenario.patch