Calling transport_generic_request_failure() from here causes list corruption. We should be using target_complete_cmd() instead. Which we do in all other cases, so the UNKNOWN_OP case can become just another member of the big else/if chain in tcmu_handle_completion().
Unified · Split
| @@ -538,14 +538,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry * · 537 unmodified lines | ||
| 538 | 538 | UPDATE_HEAD(udev->data_tail, cmd->data_length, udev->data_size); |
| 539 | 539 | pr_warn("TCMU: Userspace set UNKNOWN_OP flag on se_cmd %p\n", |
| 540 | 540 | cmd->se_cmd); |
| 541 | − transport_generic_request_failure(cmd->se_cmd, | |
| 542 | − TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE); | |
| 543 | − cmd->se_cmd = NULL; | |
| 544 | − kmem_cache_free(tcmu_cmd_cache, cmd); | |
| 545 | − return; | |
| 546 | − } | |
| 547 | − | |
| 548 | − if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) { | |
| 541 | + entry->rsp.scsi_status = SAM_STAT_CHECK_CONDITION; | |
| 542 | + } else if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) { | |
| 549 | 543 | memcpy(se_cmd->sense_buffer, entry->rsp.sense_buffer, |
| 550 | 544 | se_cmd->scsi_sense_length); |
| 551 | 545 | |