aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/target/target_core_tmr.c
diff options
context:
space:
mode:
authorJoern Engel <joern@logfs.org>2011-10-27 15:44:46 -0700
committerNicholas Bellinger <nab@linux-iscsi.org>2011-11-02 15:56:41 +0000
commitb8a11d7399173dcf23b6d0ca4f416bdf1eba982e (patch)
tree18d1c607b6aaad5e082a1ffd4d0c5406ff9482a3 /drivers/target/target_core_tmr.c
parentabc1fd4f92d86168790a9eaf9834713a41da788e (diff)
downloadkernel_goldelico_gta04-b8a11d7399173dcf23b6d0ca4f416bdf1eba982e.zip
kernel_goldelico_gta04-b8a11d7399173dcf23b6d0ca4f416bdf1eba982e.tar.gz
kernel_goldelico_gta04-b8a11d7399173dcf23b6d0ca4f416bdf1eba982e.tar.bz2
target: Avoid double list_del for aborted se_tmr_req
After the list_del() in core_tmr_drain_tmr_list(), core_tmr_release_req() would list_del() the same object again. Call graph: core_tmr_drain_tmr_list transport_cmd_finish_abort_tmr transport_generic_remove transport_free_se_cmd core_tmr_release_req So use list_del_init(), as list_del() of an initialized list_head is safe and essentially a nop. In the CONFIG_DEBUG_LIST case, list_del() actually poisons the list_head, but that is fine as we free the object directly afterwards. Signed-off-by: Joern Engel <joern@logfs.org> Cc: stable@kernel.org Signed-off-by: Nicholas Bellinger <nab@risingtidesystems.com>
Diffstat (limited to 'drivers/target/target_core_tmr.c')
-rw-r--r--drivers/target/target_core_tmr.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 2b0c528..b1b9f2d 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -152,7 +152,7 @@ static void core_tmr_drain_tmr_list(
spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
list_for_each_entry_safe(tmr_p, tmr_pp, &drain_tmr_list, tmr_list) {
- list_del(&tmr_p->tmr_list);
+ list_del_init(&tmr_p->tmr_list);
cmd = tmr_p->task_cmd;
pr_debug("LUN_RESET: %s releasing TMR %p Function: 0x%02x,"