lkml.org 
[lkml]   [2017]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 17/58] iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Nicholas Bellinger <nab@linux-iscsi.org>

    commit fce50a2fa4e9c6e103915c351b6d4a98661341d6 upstream.

    This patch fixes a NULL pointer dereference in isert_login_recv_done()
    of isert_conn->cm_id due to isert_cma_handler() -> isert_connect_error()
    resetting isert_conn->cm_id = NULL during a failed login attempt.

    As per Sagi, we will always see the completion of all recv wrs posted
    on the qp (given that we assigned a ->done handler), this is a FLUSH
    error completion, we just don't get to verify that because we deref
    NULL before.

    The issue here, was the assumption that dereferencing the connection
    cm_id is always safe, which is not true since:

    commit 4a579da2586bd3b79b025947ea24ede2bbfede62
    Author: Sagi Grimberg <sagig@mellanox.com>
    Date: Sun Mar 29 15:52:04 2015 +0300

    iser-target: Fix possible deadlock in RDMA_CM connection error

    As I see it, we have a direct reference to the isert_device from
    isert_conn which is the one-liner fix that we actually need like
    we do in isert_rdma_read_done() and isert_rdma_write_done().

    Reported-by: Andrea Righi <righi.andrea@gmail.com>
    Tested-by: Andrea Righi <righi.andrea@gmail.com>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/infiniband/ulp/isert/ib_isert.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/infiniband/ulp/isert/ib_isert.c
    +++ b/drivers/infiniband/ulp/isert/ib_isert.c
    @@ -1581,7 +1581,7 @@ isert_rcv_completion(struct iser_rx_desc
    struct isert_conn *isert_conn,
    u32 xfer_len)
    {
    - struct ib_device *ib_dev = isert_conn->cm_id->device;
    + struct ib_device *ib_dev = isert_conn->device->ib_device;
    struct iscsi_hdr *hdr;
    u64 rx_dma;
    int rx_buflen;

    \
     
     \ /
      Last update: 2017-08-09 21:55    [W:4.134 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site