Re: [PATCH-4.9.y 2/2] qla2xxx: Fix incorrect tcm_qla2xxx_free_cmd use during TMR ABORT (v2)

[Greg-KH <gregkh@linuxfoundation.org>]

On Thu, Nov 16, 2017 at 06:05:07AM +0000, Nicholas A. Bellinger wrote:
> From: Nicholas Bellinger <nab@linux-iscsi.org>
> 
> commit 6bcbb3174caa5f1ccc894f8ae077631659d5a629 upstream.
> 
> This patch drops two incorrect usages of tcm_qla2xxx_free_cmd()
> during TMR ABORT within tcm_qla2xxx_handle_data_work() and
> tcm_qla2xxx_aborted_task(), which where attempting to dispatch
> into workqueue context to do tcm_qla2xxx_complete_free() and
> subsequently invoke transport_generic_free_cmd().
> 
> This is incorrect because during TMR ABORT target-core will
> drop the outstanding se_cmd->cmd_kref references once it has
> quiesced the se_cmd via transport_wait_for_tasks(), and in
> the case of qla2xxx it should not attempt to do it's own
> transport_generic_free_cmd() once the abort has occured.
> 
> As reported by Pascal, this was originally manifesting as a
> BUG_ON(cmd->cmd_in_wq) in qlt_free_cmd() during TMR ABORT,
> with a LIO backend that had sufficently high enough WRITE
> latency to trigger a host side TMR ABORT_TASK.
> 
> (v2: Drop the qla_tgt_cmd->write_pending_abort_comp changes,
>      as they will be addressed in a seperate series)
> 
> Reported-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
> Tested-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
> Cc: Pascal de Bruijn <p.debruijn@unilogic.nl>
> Reported-by: Lukasz Engel <lukasz.engel@softax.pl>
> Cc: Lukasz Engel <lukasz.engel@softax.pl>
> Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
> Cc: Quinn Tran <quinn.tran@cavium.com>
> Cc: <stable@vger.kernel.org> # 3.10+
> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
> ---
>  drivers/scsi/qla2xxx/tcm_qla2xxx.c | 33 ---------------------------------
>  1 file changed, 33 deletions(-)

Thanks for this, but how about a backport for it for 4.4 and 3.18?

thanks,

greg k-h