---

yaml
---
r: 274337
b: refs/heads/master
c: abc1fd4
h: refs/heads/master
i:
  274335: 374cf7f
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6eb40b2af4908e9aee71e43e7a384243128c56dd
+refs/heads/master: abc1fd4f92d86168790a9eaf9834713a41da788e

trunk/drivers/target/target_core_tmr.c

@@ -118,7 +118,7 @@ static void core_tmr_drain_tmr_list(
 		/*
 		 * Allow the received TMR to return with FUNCTION_COMPLETE.
 		 */
-		if (tmr && (tmr_p == tmr))
+		if (tmr_p == tmr)
 			continue;
 
 		cmd = tmr_p->task_cmd;
@@ -151,15 +151,14 @@ static void core_tmr_drain_tmr_list(
 	}
 	spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
 
-	while (!list_empty(&drain_tmr_list)) {
-		tmr = list_entry(drain_tmr_list.next, struct se_tmr_req, tmr_list);
-		list_del(&tmr->tmr_list);
-		cmd = tmr->task_cmd;
+	list_for_each_entry_safe(tmr_p, tmr_pp, &drain_tmr_list, tmr_list) {
+		list_del(&tmr_p->tmr_list);
+		cmd = tmr_p->task_cmd;
 
 		pr_debug("LUN_RESET: %s releasing TMR %p Function: 0x%02x,"
 			" Response: 0x%02x, t_state: %d\n",
-			(preempt_and_abort_list) ? "Preempt" : "", tmr,
-			tmr->function, tmr->response, cmd->t_state);
+			(preempt_and_abort_list) ? "Preempt" : "", tmr_p,
+			tmr_p->function, tmr_p->response, cmd->t_state);
 
 		transport_cmd_finish_abort(cmd, 1);
 	}