target: Fix incorrect se_cmd assignment in core_tmr_drain_tmr_list

This patch fixes a bug in core_tmr_drain_tmr_list() where drain_tmr_list
was using the wrong se_tmr_req for cmd assignment due to a typo during the
LUN_RESET re-org.  This was resulting in general protection faults while
using the leftover bogus *tmr_p pointer from list_for_each_entry_safe().

Signed-off-by: Joern Engel <joern@logfs.org>
Cc: Joern Engel <joern@logfs.org>
Cc: stable@kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 570b144a1edb8f0ce696f1f8515b1f74a9317fbc..87d8e958b4ce2702fde957862f7ce367cab1ccae 100644 (file)
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -154,7 +154,7 @@ static void core_tmr_drain_tmr_list(
        while (!list_empty(&drain_tmr_list)) {
                tmr = list_entry(drain_tmr_list.next, struct se_tmr_req, tmr_list);
                list_del(&tmr->tmr_list);
-               cmd = tmr_p->task_cmd;
+               cmd = tmr->task_cmd;
 
                pr_debug("LUN_RESET: %s releasing TMR %p Function: 0x%02x,"
                        " Response: 0x%02x, t_state: %d\n",