Re: [PATCH] scsi: target: Clear cmd_cnt when initial counter enrollment fails

On 7/22/26 1:30 AM, Leon Romanovsky wrote:
> From: Leon Romanovsky <[email protected]>
> 
> When target_get_sess_cmd() fails during session shutdown because
> percpu_ref_tryget_live() returns false, the command keeps the
> se_cmd->cmd_cnt pointer that __target_init_cmd() assigned earlier without
> owning a reference. Final release through target_release_cmd_kref() then
> issues an unmatched percpu_ref_put().
> 
> Commit 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd
> setup") moved the cmd_cnt assignment ahead of the reference acquisition.
> Clear se_cmd->cmd_cnt whenever the initial target_get_sess_cmd() fails in
> target_init_cmd() and target_submit_tmr(), so release performs exactly one
> matching put per acquired reference.
> 
> Fixes: 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd setup")
> Signed-off-by: Leon Romanovsky <[email protected]>

Reviewed-by: Mike Christie <[email protected]>