| commit | b8a11d7399173dcf23b6d0ca4f416bdf1eba982e | |
| author | Joern Engel <joern@logfs.org> | |
| Thu, 27 Oct 2011 22:44:46 +0000 (27 15:44 -0700) | ||
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | |
| Wed, 2 Nov 2011 15:56:41 +0000 (2 15:56 +0000) | ||
| tree | 18d1c607b6aaad5e082a1ffd4d0c5406ff9482a3 | treesnapshot (tar.gz zip) |
| parent | abc1fd4f92d86168790a9eaf9834713a41da788e | commitdiff |
target: Avoid double list_del for aborted se_tmr_req
After the list_del() in core_tmr_drain_tmr_list(),
core_tmr_release_req() would list_del() the same object again.
Call graph:
core_tmr_drain_tmr_list
transport_cmd_finish_abort_tmr
transport_generic_remove
transport_free_se_cmd
core_tmr_release_req
So use list_del_init(), as list_del() of an initialized list_head is
safe and essentially a nop. In the CONFIG_DEBUG_LIST case, list_del()
actually poisons the list_head, but that is fine as we free the object
directly afterwards.
Signed-off-by: Joern Engel <joern@logfs.org>
Cc: stable@kernel.org
Signed-off-by: Nicholas Bellinger <nab@risingtidesystems.com>
After the list_del() in core_tmr_drain_tmr_list(),
core_tmr_release_req() would list_del() the same object again.
Call graph:
core_tmr_drain_tmr_list
transport_cmd_finish_abort_tmr
transport_generic_remove
transport_free_se_cmd
core_tmr_release_req
So use list_del_init(), as list_del() of an initialized list_head is
safe and essentially a nop. In the CONFIG_DEBUG_LIST case, list_del()
actually poisons the list_head, but that is fine as we free the object
directly afterwards.
Signed-off-by: Joern Engel <joern@logfs.org>
Cc: stable@kernel.org
Signed-off-by: Nicholas Bellinger <nab@risingtidesystems.com>
| drivers/target/target_core_tmr.c | diffblobblamehistory |