scsi: target: Fix cmd_count ref leak

percpu_ref_init sets the refcount to 1 and percpu_ref_kill drops it.
Drivers like iSCSI and loop do not call target_sess_cmd_list_set_waiting
during session shutdown, though, so they have been calling percpu_ref_exit
with a refcount still taken and leaking the cmd_counts memory.

Link: https://lore.kernel.org/r/1604257174-4524-3-git-send-email-michael.christie@oracle.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 693ed3fe438812a1567ca8c5d2340136cff5a1e0..46fc2ffc42b40f3e6cdd55f7afd5d8746382b54d 100644 (file)
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -238,6 +238,14 @@ EXPORT_SYMBOL(transport_init_session);
 
 void transport_uninit_session(struct se_session *se_sess)
 {
+       /*
+        * Drivers like iscsi and loop do not call
+        * target_sess_cmd_list_set_waiting during session shutdown so we
+        * have to drop the ref taken at init time here.
+        */
+       if (!se_sess->sess_tearing_down)
+               percpu_ref_put(&se_sess->cmd_count);
+
        percpu_ref_exit(&se_sess->cmd_count);
 }