Fixes problem reported by Lev Vainblat <lev@zadarastorage.com>:

The access to the session sysfs during logout may lead to the kernel oops. In iscsi_unreg_sess_done() the iscsi_session is freed, so scst_sess->tgt_priv (that previously pointed to the iscsi_session) becomes stale. The session is still accessible in sysfs until scst_sess_sysfs_del() call, but accessing to the session via sysfs may return invalid values or crash the kernel:

$ cat /sys/kernel/scst_tgt/targets/iscsi/T1/sessions/iqn.2011-04.com.zadarastorage:316:vc-0/sid
10000123d0200

[  178.769460] iscsi-scst[895] logout_exec[2718]: Logout received from initiator iqn.2011-04.com.zadarastorage:316:vc-0
[  178.769482] iscsi-scst[897] cmnd_tx_end[2900]: Closing connection at initiator's iqn.2011-04.com.zadarastorage:316:vc-0 request
[  178.769546] scst: TM fn 6
[  178.769623] scst: TM fn 6 finished, status 0
[  178.770075] scst[1645] scst_cmd_thread[4379]: Processing thread D10_0 (PID 1645) finished
[  178.770111] scst[1646] scst_cmd_thread[4379]: Processing thread D10_1 (PID 1646) finished
[  178.770131] scst[1647] scst_cmd_thread[4379]: Processing thread D10_2 (PID 1647) finished
[  178.770150] scst[1648] scst_cmd_thread[4379]: Processing thread D10_3 (PID 1648) finished
[  178.770168] scst[1649] scst_cmd_thread[4379]: Processing thread D10_4 (PID 1649) finished
[  178.770186] scst[1650] scst_cmd_thread[4379]: Processing thread D10_5 (PID 1650) finished
[  178.770204] scst[1651] scst_cmd_thread[4379]: Processing thread D10_6 (PID 1651) finished
[  178.770223] scst[1652] scst_cmd_thread[4379]: Processing thread D10_7 (PID 1652) finished

$ cat /sys/kernel/scst_tgt/targets/iscsi/T1/sessions/iqn.2011-04.com.zadarastorage:316:vc-0/sid
0

$ echo 1> /sys/kernel/scst_tgt/targets/iscsi/T1/sessions/iqn.2011-04.com.zadarastorage:316:vc-0/force_close

[  193.150420] iscsi-scst[1555] iscsi_sess_force_close[389]: Deleting session 0 with initiator (null) (ffff880078316000)
[  193.150461] BUG: unable to handle kernel NULL pointer dereference at           (null)
[  193.150545] IP: [<ffffffffa034d034>] iscsi_sess_force_close+0xc4/0x170 [iscsi_scst]
[  193.150628] PGD 78218067 PUD 79666067 PMD 0
[  193.150678] Oops: 0000 [#1] SMP
[  193.150716] last sysfs file: /sys/kernel/scst_tgt/targets/iscsi/T1/sessions/iqn.2011-04.com.zadarastorage:316:vc-0/force_close
[  193.150824] CPU 0
[  193.150844] Modules linked in: ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi dm_iostat scst_vdisk iscsi_scst scst libcrc32c nfsd psmouse exportfs serio_raw virtio_ball   oon nfs lockd fscache nfs_acl auth_rpcgss i2c_piix4 sunrpc lp parport floppy raid10 raid456 async_pq async_xor xor async_memcpy async_raid6_recov ixgbevf raid6_pq async_tx raid1 raid0 multipath linear [last unloaded: scsi_transport_is   csi]
[  193.151359]
[  193.151377] Pid: 1555, comm: bash Not tainted 2.6.38-8-server #42-Ubuntu Bochs Bochs
[  193.151456] RIP: 0010:[<ffffffffa034d034>]  [<ffffffffa034d034>] iscsi_sess_force_close+0xc4/0x170 [iscsi_scst]
[  193.151556] RSP: 0018:ffff88007a247e28  EFLAGS: 00010287
[  193.151604] RAX: 000000000000007f RBX: fffffffffffffe30 RCX: 000000000003ffff
[  193.153372] RDX: 0000000000000000 RSI: 0000000000000086 RDI: 0000000000000246
[  193.155115] RBP: ffff88007a247e68 R08: 0000000000000036 R09: 000000000000b874
[  193.156878] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800783170a0
[  193.158640] R13: ffff88007a247fd8 R14: ffff88007828c4a0 R15: ffff880078573600
[  193.160112] FS:  00007f9d23092720(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
[  193.160112] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  193.160112] CR2: 0000000000000000 CR3: 00000000787e6000 CR4: 00000000000006f0
[  193.160112] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  193.160112] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  193.160112] Process bash (pid: 1555, threadinfo ffff88007a246000, task ffff88007828c4a0)
[  193.160112] Stack:
[  193.160112]  0000000000000000 ffff880078316000 0000000000000000 0000000000000000
[  193.160112]  ffff880078316000 0000000000000001 ffff8800370ea5a0 ffffffffa02de9c0
[  193.160112]  ffff88007a247e88 ffffffffa034d138 ffff880078573620 ffff88007a247f48
[  193.160112] Call Trace:
[  193.160112]  [<ffffffffa034d138>] iscsi_sess_force_close_store+0x58/0xd0 [iscsi_scst]
[  193.160112]  [<ffffffffa02bf31c>] scst_store+0x1c/0x20 [scst]
[  193.160112]  [<ffffffff811d35f1>] sysfs_write_file+0xd1/0x160
[  193.160112]  [<ffffffff811652e6>] vfs_write+0xc6/0x180
[  193.160112]  [<ffffffff81165601>] sys_write+0x51/0x90
[  193.160112]  [<ffffffff8100bfc2>] system_call_fastpath+0x16/0x1b
[  193.160112] Code: 1f 84 00 00 00 00 00 f6 05 ea ef 00 00 08 75 68 48 89 df be 03 00 00 00 e8 ca d3 ff ff 48 8b 9b d0 01 00 00 48 81 eb d0 01 00 00 <48> 8b 83 d0 01 00 00 0f 18 08 48 8d 83 d0 01 00 00 4c 39 e0 75
[  193.160112] RIP  [<ffffffffa034d034>] iscsi_sess_force_close+0xc4/0x170 [iscsi_scst]
[  193.160112]  RSP <ffff88007a247e28>
[  193.160112] CR2: 0000000000000000
[  193.200380] ---[ end trace 1988466f0a8da036 ]---



git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@3940 d57e44dd-8a1f-0410-8b47-8ef2f437770f

scst/src/scst_lib.c

@@ -4010,11 +4010,18 @@ void scst_free_session(struct scst_session *sess)
 
 	scst_sess_free_tgt_devs(sess);
 
-#ifndef CONFIG_SCST_PROC
 	mutex_unlock(&scst_mutex);
+
+#ifndef CONFIG_SCST_PROC
 	scst_sess_sysfs_del(sess);
-	mutex_lock(&scst_mutex);
 #endif
+	if (sess->unreg_done_fn) {
+		TRACE_DBG("Calling unreg_done_fn(%p)", sess);
+		sess->unreg_done_fn(sess);
+		TRACE_DBG("%s", "unreg_done_fn() returned");
+	}
+
+	mutex_lock(&scst_mutex);
 
 	/*
 	 * The lists delete must be after sysfs del. Otherwise it would break
@@ -4065,11 +4072,6 @@ void scst_free_session_callback(struct scst_session *sess)
 	sess->shut_phase = SCST_SESS_SPH_UNREG_DONE_CALLING;
 	mutex_unlock(&scst_mutex);
 
-	if (sess->unreg_done_fn) {
-		TRACE_DBG("Calling unreg_done_fn(%p)", sess);
-		sess->unreg_done_fn(sess);
-		TRACE_DBG("%s", "unreg_done_fn() returned");
-	}
 	scst_free_session(sess);
 
 	if (c)