Calling transport_generic_request_failure() from here causes list corruption. We should be using target_complete_cmd() instead. Which we do in all other cases, so the UNKNOWN_OP case can become just another member of the big else/if chain in tcmu_handle_completion().
Unified · Split
| @@ -538,14 +538,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry * · 537 unmodified lines | |||
| 538 | UPDATE_HEAD(udev->data_tail, cmd->data_length, udev->data_size); | 538 | UPDATE_HEAD(udev->data_tail, cmd->data_length, udev->data_size); |
| 539 | pr_warn("TCMU: Userspace set UNKNOWN_OP flag on se_cmd %p\n", | 539 | pr_warn("TCMU: Userspace set UNKNOWN_OP flag on se_cmd %p\n", |
| 540 | cmd->se_cmd); | 540 | cmd->se_cmd); |
| 541 | transport_generic_request_failure(cmd->se_cmd, | 541 | entry->rsp.scsi_status = SAM_STAT_CHECK_CONDITION; |
| 542 | TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE); | 542 | } else if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) { |
| 543 | cmd->se_cmd = NULL; | ||
| 544 | kmem_cache_free(tcmu_cmd_cache, cmd); | ||
| 545 | return; | ||
| 546 | } | ||
| 547 | |||
| 548 | if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) { | ||
| 549 | memcpy(se_cmd->sense_buffer, entry->rsp.sense_buffer, | 543 | memcpy(se_cmd->sense_buffer, entry->rsp.sense_buffer, |
| 550 | se_cmd->scsi_sense_length); | 544 | se_cmd->scsi_sense_length); |
| 551 | 545 | ||