Re: [PATCH] scsi: target: Clear cmd_cnt when initial counter enrollment fails

On Wed, 22 Jul 2026 09:30:10 +0300, Leon Romanovsky wrote:

> When target_get_sess_cmd() fails during session shutdown because
> percpu_ref_tryget_live() returns false, the command keeps the
> se_cmd->cmd_cnt pointer that __target_init_cmd() assigned earlier without
> owning a reference. Final release through target_release_cmd_kref() then
> issues an unmatched percpu_ref_put().
> 
> Commit 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd
> setup") moved the cmd_cnt assignment ahead of the reference acquisition.
> Clear se_cmd->cmd_cnt whenever the initial target_get_sess_cmd() fails in
> target_init_cmd() and target_submit_tmr(), so release performs exactly one
> matching put per acquired reference.
> 
> [...]

Applied to 7.2/scsi-fixes, thanks!

[1/1] scsi: target: Clear cmd_cnt when initial counter enrollment fails
      https://git.kernel.org/mkp/scsi/c/a8ddfd2425bb

-- 
Martin K. Petersen