scsi: target: core: Flush submission work during TMR processing

If a cmd is on the submission workqueue then the TMR code will miss it, and
end up returning task not found or success for LUN resets. The fabric
driver might then tell the initiator that the running cmds have been
handled when they are about to run.

This adds a flush when we are processing TMRs to make sure queued cmds do
not run after returning the TMR response.

Link: https://lore.kernel.org/r/[email protected]
Tested-by: Laurence Oberman <[email protected]>
Reviewed-by: Bodo Stroesser <[email protected]>
Signed-off-by: Mike Christie <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>

Author: mikechristie

drivers/target/target_core_tmr.c

@@ -124,6 +124,8 @@ void core_tmr_abort_task(
 	int i;
 
 	for (i = 0; i < dev->queue_cnt; i++) {
+		flush_work(&dev->queues[i].sq.work);
+
 		spin_lock_irqsave(&dev->queues[i].lock, flags);
 		list_for_each_entry_safe(se_cmd, next, &dev->queues[i].state_list,
 					 state_list) {
@@ -302,6 +304,8 @@ static void core_tmr_drain_state_list(
 	 * in the Control Mode Page.
 	 */
 	for (i = 0; i < dev->queue_cnt; i++) {
+		flush_work(&dev->queues[i].sq.work);
+
 		spin_lock_irqsave(&dev->queues[i].lock, flags);
 		list_for_each_entry_safe(cmd, next, &dev->queues[i].state_list,
 					 state_list) {