iscsi-scst: handle a case in target_del() where the target was alread…

…y freed target_del() calls handle_iscsi_events() which may recursively call target_del(). The 1st target_del() may resume its execution after the target object was already freed. Signed-off-by: Erez Zilber <[email protected]>
arturpzol · Jul 2, 2016 · a883013 · a883013
1 parent b7803de
commit a883013
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/iscsi-scst/usr/target.c b/iscsi-scst/usr/target.c
@@ -357,6 +357,13 @@ int target_del(u32 tid, u32 cookie)
 		/* We might need to handle session(s) removal event(s) from the kernel */
 		while (handle_iscsi_events(nl_fd, false) == 0);
 
+		/* Someone else may have already freed the target object by now. */
+		target = target_find_by_id(tid);
+		if (!target) {
+			log_info("%s: the target with tid = %u was already freed", __func__, tid);
+			return 0;
+		}
+
 		if (list_empty(&target->sessions_list))
 			break;